Adobe Air - reading information from an LDAP server
I have an AIR application and want to connect to an LDAP server to get some information for a specific user.
The url is like ldap: // ldapservername: 389 /
I would like to pass userid / Name as a parameter and hopefully get the full name, email address, etc.
Can you provide suggestions for implementing this? A dedicated Windows solution works great for me as well.
a source to share
Adobe AIR does not support native LDAP support. All online examples go through a server for LDAP integration.
Example: Executing an LDAP query to resolve the role http://www.adobe.com/devnet/livecycle/articles/perform_ldap_resolution.html
Aside from using the server, you are limited to two options, neither of which is good.
-
Completely re-implement the LDAP protocol implementation in AIR. I think it's possible, but it's a huge challenge. With Alchemy, you could theoretically recompile an existing C library to work with AIR, but I don't know how well that would work for this particular use case. Plus it's a research project, not a production readiness.
-
Embed your own application. With AIR 2.0, you can include your own application, written in C or .NET, or otherwise, and run it to make LDAP calls. The only way to communicate with this other process is through stdin / stdout, so it is not easy to pass complex / typed data, but it is possible.
AIR is not suitable for all applications. If all your application requirements can be met in the AIR API, that's great. But if you need to do something that is not directly supported by AIR and do not have a server component, you are better off not using AIR.
a source to share
You will probably need to do regular LDAP stuff. Either start with the user's full DN (rare), or look for it.
Bind to LDAP directory as proxy user or as anonymous bind. Query for ATTR = VALUE, where ATTR is what you define as a unique value in the catalog. Traditionally, this is the uid on LDAP servers. For Active Directory, it would probably be better to look for ATTR from sAMAccountName. Save this as a configuration option for the administrator, as it will make it easier to work across different LDAP servers.
It could be mail, and the login value the user enters is their email address. Depends on the use case. But leave it customizable to be flexible.
Then the lookup should return one value with the full DN, and then you want to bind it with the full DN and the password provided. I like the bind-like approach as a user, instead of comparing the password, since then you increment any last login attributes and the like, which makes it easier to detect account inactivity from the perspective of directory administrators.
a source to share