JNDI + LDAP + Active Directory + ObjectChangeListener

[mrboomi]

Hello,

I am looking for an example that combines the above technologies.

The documentation I have been able to find says that ActiveDirectory
does not implement the persistent search control mechanism and thus
prevents the use of a NamingListener or ObjectChangeListener.

I have found other posts such as:

http://archives.java.sun.com/cgi-bin/wa?A2=ind0205&L=jndi-interest&F=&S=&P=3878

that give me some hope that someone has been able to implement a work
around, however no concrete examples have been forthcoming.

My dilema is that I need to integrate a central
Authentication/Auditing server with Active Directory and other LDAP
enabled server applicaltions, such as OpenLDAP.

The Authentication app in "native" mode maintains its own user datbase
and ideally would maintain a replica of user information when swicthed
over to "LDAP" mode. The need to maintain a syncronized replica is a
result of the auditing that needs to be performed for any of our
client applications that authenticate against the Authentication
server. ie. we need to be able to trace accountability for any log
events, logged through the Authentication server.

I have the JNDI authentication and initial data retrieval from Active
Directory woking ok. BUT I need to be alerted by Active Directory
when, for example, a Username is altered so that this can then be
replicated to my Authentication server db. Essentially I am only
interested in the username becuase it will form the unique key of my
database. As long as I have a handle in my database to the User within
Active Directory I will be able to query and update any other
demographics that may have changed.

Any insight/help/examples would be much appreciated.

My contact email is: (e-mail address removed)

Kind Regards

Josh.

 

[Andrew Thompson]

I am looking for an example that combines the above technologies.

Please refrain from multi-posting Josh.
<http://www.physci.org/codes/javafaq.jsp#xpost>

--
Andrew Thompson
http://www.PhySci.org/codes/ Web & IT Help
http://www.PhySci.org/ Open-source software suite
http://www.1point1C.org/ Science & Technology
http://www.lensescapes.com/ Images that escape the mundane

 

[JScoobyCed]

Hello,

Hi,

BUT I need to be alerted by Active Directory
when, for example, a Username is altered so that this can then be
replicated to my Authentication server db. Essentially I am only
interested in the username becuase it will form the unique key of my
database.

I wouldn't advise that. Why don't you use the DN (Distinguished Name) as
primary key ? It is unique on the Active Directory server, as well as
other domain defined in the forest (in a case of multi-domain). If you
have two username equal, how will you handle that ? Moreover, the DN
won't change for the user. You would then have a relation username-DN to
update your database.

 

[mrboomi]

Thanks for your advice.

I think what I have decided to do is to use the objectGUID as the
primary key (converted to a HexString ) as this - as published by MS -
never alters for a user. I would imagine it is still possible for a
User's DN to change when, for example, their user name is
altered/changed/updated.

In terms of LDAP, my db will hold only the objectGUID and the user's
DN - both for auditability and logging purposes... ie. I want a highly
normalised LOG relation.

Thanks Again and sorry for the multi posts.

Josh