Question:

We have a small LAN where each user is logging into Windows via Active Directory server. I want to be able to authenticate users from Java code in the same way. I was doing this in the following way:

Hashtable <String, String> env = new Hashtable <>(); env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory"); env.put(Context.PROVIDER_URL, "ldap://192.168.0.1:389"); env.put(Context.SECURITY_AUTHENTICATION, "simple"); env.put(Context.SECURITY_PRINCIPAL, "user1"); env.put(Context.SECURITY_CREDENTIALS, "pass1")); env.put(Context.REFERRAL, "ignore"); try { new InitialDirContext(env).close(); return true; } catch (AuthenticationException ex) { return false; }

where user1 and pass1 was user credentals.

That worked fine until local administrator restricted access by explicitly setting a list of allowed workstations for each user. Now users are still able to log into Windows, but my code (executed on allowed workstation) produces

javax.naming.AuthenticationException: [LDAP: error code 49 - ...: LdapErr: ..., comment: AcceptSecurityContext error, data 531, ...]

where <a href="https://confluence.atlassian.com/display/CONFKB/LDAP+Error+Code+49" rel="nofollow">"data 531" means "not permitted to logon at this workstation"</a>.

So the question is: how should I authenticate a user on LDAP server when user's allowed workstations are set? Should I somehow pass current workstation to the LDAP server or what?

Allowed workstations parameter is set in the AD in <strong>userWorkstations</strong> attribute.

So you may need to set the server name that hosts your java code to the <strong>userWorkstations</strong> attribute in the AD for the login user.

Refere to below link for more details

<a href="https://stackoverflow.com/questions/18766158/cant-get-connection-with-ad-from-java-code/18767613#18767613?newreg=854061f7965244399fec2b7757c3b325" rel="nofollow">Can't get connection with AD from Java code</a>

<blockquote>

I want to be able to authenticate users from Java code in the same way.

</blockquote>

Then you want Kerberos and not LDAP bind.