Name: ddT132432			Date: 10/12/2001


java version "1.4.0-beta2"
Java(TM) 2 Runtime Environment, Standard Edition (build 1.4.0-beta2-b77)
Java HotSpot(TM) Client VM (build 1.4.0-beta2-b77, mixed mode)


One of the problems that I found with regard to using StartTLS with JNDI and
LDAP is that you end up doing two binds, one anonymously and one as the user
that you want to authenticate as.

For example, the following lines taken from the access log on a iPlanet
Directory Server 5.0. As you can see, it first binds as "", and then
as "cn=Directory Manager".

[10/Oct/2001:17:49:08 -0500] conn=19 fd=28 slot=28 connection from 128.135.99.6
to 128.135.99.138
[10/Oct/2001:17:49:08 -0500] conn=19 op=0 BIND dn="" method=128 version=3
[10/Oct/2001:17:49:08 -0500] conn=19 op=0 RESULT err=0 tag=97 nentries=0
etime=0 dn=""
[10/Oct/2001:17:49:08 -0500] conn=19 op=1 EXT oid="1.3.6.1.4.1.1466.20037"
[10/Oct/2001:17:49:08 -0500] conn=19 op=1 RESULT err=0 tag=120 nentries=0
etime=0
[10/Oct/2001:17:49:14 -0500] conn=19 SSL 128-bit RC4
[10/Oct/2001:17:49:14 -0500] conn=19 op=2 BIND dn="cn=Directory Manager"
method=128 version=3
[10/Oct/2001:17:49:14 -0500] conn=19 op=2 RESULT err=0 tag=97 nentries=0
etime=0 dn="cn=directory manager"
[10/Oct/2001:17:49:14 -0500] conn=19 op=3 SRCH base="ou=People, dc=uchicago,
dc=edu" scope=2 filter="(uid=jemiller)" attrs=ALL
[10/Oct/2001:17:49:14 -0500] conn=19 op=3 RESULT err=0 tag=101 nentries=1
etime=0
[10/Oct/2001:17:49:14 -0500] conn=19 op=4 UNBIND
[10/Oct/2001:17:49:14 -0500] conn=19 op=4 fd=28 closed - U1

It does this even though I have Context.SECURITY_AUTHENTICATION set to "none"
initially. IMHO, it should not do a bind at all for performance reasons.

For example, if you use the command-line ldapsearch command that comes with
iPlanet Directory Server, you see that it does not do a bind if you don't
authenticate.

import java.security.*;
import java.util.*;
import javax.naming.*;
import javax.naming.directory.*;
import javax.naming.ldap.*;

public class JNDITLSSearch
{
	public static void main (String[] args)
	{
		try
		{
			if(args.length != 6)
			{
				System.err.println("Usage: JNDITLSSearch host port user password baseDN filter");
				System.exit(-1);
			}
				
			String host = args[0];
			int port = Integer.parseInt(args[1]);
			String user = args[2];
			String password = args[3];
			String baseDN = args[4];
			String filter = args[5];
			Hashtable h = new Hashtable();
			h.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
			h.put(Context.PROVIDER_URL, "ldap://" + host + ":" +port);
			h.put(Context.SECURITY_AUTHENTICATION, "none");
			LdapContext lc = new InitialLdapContext(h, null);
			StartTlsResponse stlsr = (StartTlsResponse)lc.extendedOperation(new StartTlsRequest());
			stlsr.negotiate();
			lc.addToEnvironment(Context.SECURITY_AUTHENTICATION, "simple");
			lc.addToEnvironment(Context.SECURITY_PRINCIPAL, user);
			lc.addToEnvironment(Context.SECURITY_CREDENTIALS,password);
			SearchControls sc = new SearchControls();
			sc.setSearchScope(SearchControls.SUBTREE_SCOPE);	
			NamingEnumeration ne = lc.search(baseDN, filter, sc);
			while(ne.hasMore())
			{
				System.out.println((SearchResult)ne.next());
			}
			lc.close();
		}
		catch(Exception e)
		{
			e.printStackTrace();
			System.exit(-1);
		}
	}
}
(Review ID: 133510) 
======================================================================