user authentication ldap

[Stefan Gerber]

Hello
I would like to know what the best way is to authenticate a user (username and password).

one way would be to search for username and password like this:

  
NamingEnumeration<SearchResult> results = search("dc=microsoft, dc=com", (&(sn=USERNAME) (userPassword=PASSWORD)));
 
if (results.hasMoreElements()) {
try {
results.next();
} catch (NamingException e) {
e.printStackTrace();
}
lUserExists = true;
}

are there other/better ways to authenticate a user?

[Ben Souther]

"Stefan",
Please check your private messages.
-Ben

[Roseanne Zhang]

I don't think you should store user's password.

User password should be one way encrypted by MD5 or other hash algorithm.

When user login, you hash the password to compare with the stored password hash in the database.

This is security ABC.

[Joe Ess]

LDAP Authentication Example from the JNDI tutorial.
If you are using an application server, it is also possible to set up container-managed security that takes care of the ugly details for you.