[LDAP] PartialResultException 해결책

AD서버의 Active Directory를 조회하기위해 LDAP 쿼리를 실행 할때
아래 에러 내용과 같은 PartialResultException이 나타나는 경우가 있습니다.
이때 4가지의 해결 방법이 있습니다.

 

Caused by: org.springframework.ldap.PartialResultException: Unprocessed Continuation Reference(s); nested exception is javax.naming.PartialResultException: Unprocessed Continuation Reference(s); remaining name '/'
   at org.springframework.ldap.support.LdapUtils.convertLdapException(LdapUtils.java:216)
   at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:385)
   at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:309)
   at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:642)
   at org.springframework.ldap.core.LdapTemplate.search(LdapTemplate.java:578)
   at org.springframework.ldap.core.LdapTemplate.find(LdapTemplate.java:1840)
   at org.springframework.ldap.core.LdapTemplate.findAll(LdapTemplate.java:1806)
   at org.springframework.ldap.core.LdapTemplate.findAll(LdapTemplate.java:1814)
   at org.springframework.data.ldap.repository.support.SimpleLdapRepository.findAll(SimpleLdapRepository.java:190)
   at org.springframework.data.ldap.repository.support.SimpleLdapRepository.findAll(SimpleLdapRepository.java:43)
   at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
   at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
   at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
   at java.lang.reflect.Method.invoke(Unknown Source)
   at org.springframework.data.repository.core.support.RepositoryFactorySupport$QueryExecutorMethodInterceptor.executeMethodOn(RepositoryFactorySupport.java:504)
   at org.springframework.data.repository.core.support.RepositoryFactorySupport$QueryExecutorMethodInterceptor.doInvoke(RepositoryFactorySupport.java:489)
   at org.springframework.data.repository.core.support.RepositoryFactorySupport$QueryExecutorMethodInterceptor.invoke(RepositoryFactorySupport.java:461)
   at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
   at org.springframework.aop.interceptor.ExposeInvocationInterceptor.invoke(ExposeInvocationInterceptor.java:92)
   at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
   at org.springframework.data.repository.core.support.SurroundingTransactionDetectorMethodInterceptor.invoke(SurroundingTransactionDetectorMethodInterceptor.java:57)
   at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179)
   at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:213)
   at com.sun.proxy.$Proxy44.findAll(Unknown Source)

 

 

1) 해결책 1

baseDN의 값이  "DC=test,DC=com"와 같이 도메인으로만 지정되어 있을경우

OU위치가 포함된 상세한 baseDN을 지정합니다. "OU=userVDI,DC=test,DC=com"

 

 

2) 해결책 2

Spring Bean 설정에서 PartialResultException의 오류를 무시하도록 설정
아래 코드와 같이 ldapTemplate.setIgnorePartialResultException(true); 로 지정하여
PartialResultException의 이 안나오도록 설정합니다.

@Bean                                                    
public LdapTemplate ldapTemplate() throws Exception {    
   LdapTemplate ldapTemplate = new LdapTemplate();       
   ldapTemplate.setIgnorePartialResultException(true);   
   ldapTemplate.setContextSource(getAdContextSource());  
   return ldapTemplate;                                  
}                                                        

 

 

3) 해결책 3

Spring Bean 설정에서 Referral의 값을 follow로 지정합니다.
아래 코드와 같이 ldapContextSource.setReferral("follow"); 로 지정하여
LDAP쿼리가 정상적으로 실행되도록 합니다.

@Bean                                                               
 public LdapContextSource getAdContextSource() throws Exception {   
    LdapContextSource ldapContextSource = new LdapContextSource();  
    ldapContextSource.setUrl(urls);                                 
    ldapContextSource.setBase(base);                                
    ldapContextSource.setUserDn(username);                          
    ldapContextSource.setPassword(password);                        
    ldapContextSource.setReferral("follow");                        
    //ldapContextSource.setPooled(true);                            
                                                                    
    Map<String, Object> baseEnv = new Hashtable<String, Object>();  
                                                                    
    baseEnv.put("java.naming.ldap.attributes.binary", "objectSid"); 
    ldapContextSource.setBaseEnvironmentProperties(baseEnv);        
                                                                    
    return ldapContextSource;                                       
 }                                                                  

 

 

 

4) 해결책 4

AD의 port를 389가 아닌 3268로 변경합니다.

# ldap://[AD IP]:3268

 

port 389와 3268의 차이는 다음과 같습니다.

port 389 - 이 포트는 로컬 도메인 컨트롤러에서 정보를 요청하는 데 사용됩니다. 389 포트로 보낸 LDAP 요청을 사용하여 글로벌 카탈로그의 홈 ​​도메인 내에서만 개체를 ​​검색 할 수 있습니다. 그러나 요청하는 응용 프로그램은 해당 오브젝트에 대한 모든 속성을 확보 할 수 있습니다. 예를 들어, 포트 389에 대한 요청을 사용하여 사용자의 부서를 얻을 수 있습니다.

 

port 3268 - 이 포트는 특별히 글로벌 카탈로그를 대상으로하는 쿼리에 사용됩니다. 3268 포트로 전송 된 LDAP 요청을 사용하여 전체 포리스트의 개체를 검색 할 수 있습니다. 그러나 글로벌 카탈로그로 복제하도록 표시된 특성 만 반환 할 수 있습니다. 예를 들어이 특성은 글로벌 카탈로그에 복제되지 않으므로 사용자의 부서는 포트 3268을 사용하여 반환 될 수 없습니다.

 

지금까지 LDAP PartialResultException의 해결책에 대한 내용이었습니다.