尝试使用java CertStore从Windows Active directory检索用户证书，但未成功

我正在尝试从Windows Active Directory检索与域名关联的用户证书，但在使用Java API时遇到困难

例如，当我使用“ldapsearch”命令工具时，我能够检索证书，如下面所示

ldapsearch -h 192.xx.2.xx  -D "CN=Administrator,CN=Users,DC=mmo,DC=co,DC=ca" -w Password -b "CN=rsa0,CN=Users,DC=mmo,DC=co,DC=ca" "userCertificate"

# extended LDIF
#
# LDAPv3
# base <CN=rsa0,CN=Users,DC=mmo,DC=co,DC=ca> with scope subtree
# filter: (objectclass=*)
# requesting: userCertificate 
#

# rsa0, Users, mmo.co.ca
dn: CN=rsa0,CN=Users,DC=mmo,DC=co,DC=ca
userCertificate:: MIIDbTCCAlWgAwIBAgIEFbvHazANBgkqhkiG9w0BAQsFADBnMQswCQYDVQQG
 EwJ1azEQMA4GA1UECBMHVW5rbm93bjEWMBQGA1UEBxMNcmlja21hbnN3b3J0aDERMA8GA1UEChMId
 m9jYWxpbmsxDDAKBgNVBAsTA2lwczENMAsGA1UEAxMEcnNhMDAeFw0xOTExMjExNDUwNDNaFw0yOT
 ExMTgxNDUwNDNaMGcxCzAJBgNVBAYTAnVrMRAwDgYDVQQIEwdVbmtub3duMRYwFAYDVQQHEw1yaWN
 rbWFuc3dvcnRoMREwDwYDVQQKEwh2b2NhbGluazEMMAoGA1UECxMDaXBzMQ0wCwYDVQQDEwRyc2Ew
 MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0R0yCr0uU80oFG3Zg0vTbR4NSR2St+w4f
 DOmoHQ27z1Q2JwhiNh1XkwC8MtVeGzRJw0pe+jXc2fMVbIqONHImOZuX6p1UMWof7fxMAIEfWq98u
 OqVbvbXVLeCE9+BJGsOaiJ70Q76e8tDNTH3vg1orXAvb0O7R0Vz9I0iXjJKzUtmFEBju/m3eoa+WI
 6OaBr64hJw7oz1CzPIKj0OcapFypFjr4+QKpRsHA4Nn21XrYSsT00Dk9SVK3NTjHm661crvTR6jSx
 j1GrCpVdQGCQ25a2RrHIi0cmclNJmy81PngW0cpdO3p9ZsZ2vPUy5/CNbVwqPEPSlIjJtVa0Xf9O1
 QIDAQABoyEwHzAdBgNVHQ4EFgQU1U7VOM/vAHL0pqZgi6TS1f0SAt8wDQYJKoZIhvcNAQELBQADgg
 EBAC7fK81BHDbF8PSQO2YznZtnzCMs46TwCezyqIFzQljwYA5wxKIytV7GtV4aEUrfIFIeQIMW812
 pMol9xIotULSl1I/2WI18QTIJfRAnkCZZPJIa9MU6nEGCouF1LwW9bzQzHOeI07NgCIyBryojXaxc
 L/epJtVxYialdI9mBWB8KDytINrylOcP9sXYaUtkOOiU7h0sBF9XBfzXgtTkF8pB7ObX9YJnyvzTn
 y2zVfeZD8Q7BtDL7AvIDcUjoHtYx5B0oD86aCNTSShmtB/ZEyqt8Kynqf+QUYQIWA3wVFjgZjCCwc
 NxiXuf6H8KGW8hP+ETKnc7u9XP9GCHINf9K0I=

# search result
search: 2
result: 0 Success

# numResponses: 2
# numEntries: 1

当我运行这个程序时，我得到的大小是0，而我期望的大小是1

调用main（）。 尺寸：0

我还让openldap在linux系统上运行，在上面的java程序中，如果我指向该服务器并使用适当的域名信息，java能够提取与该域名相关的证书

不确定尝试从Windows Active Directory检索证书时缺少什么

---

有谁能解释一下这一点，因为我已经被困了几天。

我的盲目猜测是，您需要对自己进行身份验证才能从Active Directory中读取任何内容，并且上面的代码似乎没有使用任何凭据来读取LDAP。如果您想连接到windows AD而不绑定（或匿名绑定）我们需要在Windows广告中更改以下属性。我已经这样做了1。启动Adsiedit.msc（启动、运行、Adsiedit.msc）。2.展开配置容器。扩展服务，Windows NT。3.右键单击CN=目录服务并选择属性。4.双击dSHeuristics属性。5.如果该值当前为，则将其设置为0000002。如果当前不是空的，则必须将字符串的第7个字符更改为2。（例如，如果它是001，0010002应该是您的新值。单击“确定”。

package CertStore;

import javax.naming.AuthenticationException;
import javax.naming.AuthenticationNotSupportedException;
import javax.naming.Context;
import javax.naming.NamingException;
import javax.naming.directory.DirContext;
import javax.naming.directory.InitialDirContext;
import javax.security.auth.x500.X500Principal;
import java.security.cert.*;
import java.util.*;
import java.io.*;

class CertStoreTest {
    CertStoreTest() {
        try {
            LDAPCertStoreParameters lcsp =
                    new LDAPCertStoreParameters("192.xx.2.xx", 389);

            String referenceID = "CN=rsa0,CN=Users,DC=bmo,DC=co,DC=ca";

            X509CertSelector xcs = new X509CertSelector();
            xcs.setSubject(referenceID);

            CertStore cs = CertStore.getInstance("LDAP", lcsp);

            Collection certificates = cs.getCertificates((CertSelector)xcs);

            System.out.println("size: "+ certificates.size());
            Iterator certificate = certificates.iterator();

            while(certificate.hasNext()) {
                System.out.println(certificate.next());
            }
        } catch(Exception e) {
            e.printStackTrace();
        }

    }
    public static void main(String[] args) {
        System.out.println("main() called.");
        CertStoreTest test = new CertStoreTest();
    }
}