Windows password Authentication with LDAP

Question

I have a desktop application and i can get the domain username with authentication.getPrincipal().toString() code line.If the domain name and the user input matches exactly i granted all access to user .On the other hand , when the user types another username(which doesn't match the domain user name ) ,the programme checks the password in Database.

The problem is that I want to check the password with windows domain passwords not with DB.When the user writes the username , the programme should lookup windows domain password for this username.I try LDAP but I couldn't get the domain password with LDAP.

Is there any possible way to check the users with domain passwords? In other meaning , is there a possible way to lookup the password which belongs to user?

Answer 1

It should be impossible to retrieve passwords (noone should be able to get another user's password).

However, if they are accessing while logged in as that account you don't need to check the password. The fact you can go authentication.getPrincipal shows that they are logged in as that user - you no longer need to ask for a password.

Alternatively, if they are accessing using a given windows-auth username and password while not logged in as that user there may be a way to see if their password is valid but I doubt it because the IsValid() boolean call would let you know the password you just handed over was valid and as such Windows has leaked their password.

Edit:

Java LDAP Authentication code (source: http://java.sun.com/products/jndi/tutorial/ldap/security/ldap.html)

// Set up the environment for creating the initial context
Hashtable env = new Hashtable();
env.put(Context.INITIAL_CONTEXT_FACTORY, 
    "com.sun.jndi.ldap.LdapCtxFactory");
env.put(Context.PROVIDER_URL, "ldap://localhost:389/o=JNDITutorial");

// Authenticate
env.put(Context.SECURITY_AUTHENTICATION, "simple");
env.put(Context.SECURITY_PRINCIPAL, authentication.getPrincipal().toString() );
env.put(Context.SECURITY_CREDENTIALS, "PASSWORD");

// Create the initial context
DirContext ctx = new InitialDirContext(env);