.NET 8 Linux下LDAP认证LdapException.ServerErrorMessage为空问题

在Windows系统中使用LDAP认证时，可正常获取ServerErrorMessage来处理具体错误，但在Linux系统中该字段始终为空。已确认这是.NET Runtime的已知问题，以下是当前使用的LDAP认证代码：

public void Authenticate(string username, string password)
{
    var ldapUsername = $"{_ldapDomain}\\{username}";
    var ldapPassword = password;

    using var connection = new LdapConnection(new LdapDirectoryIdentifier(_ldapServer, _ldapPort));

    connection.AuthType = AuthType.Basic;
    connection.Credential = new System.Net.NetworkCredential(ldapUsername, ldapPassword);
    connection.SessionOptions.ProtocolVersion = 3;


    try
    {
        connection.Bind();
    }
    catch (LdapException ex)
    {
        var message = ex.ErrorCode switch
        {
            49 => ex.ServerErrorMessage switch
            {
                string s when s.Contains("data 525") => "User not found. Please check your username.",
                string s when s.Contains("data 52e") => "AD authentication failed. Please check your username and password.",
                string s when s.Contains("data 530") => "Login not permitted at this time. Please contact your administrator.",
                string s when s.Contains("data 531") => "Login not permitted from this workstation. Please contact your administrator.",
                string s when s.Contains("data 532") => "Password expired. Please update your password.",
                string s when s.Contains("data 533") => "Account disabled. Please contact your administrator.",
                string s when s.Contains("data 534") => "Login requires a secure connection. Please ensure you are using a secure connection and try again.",
                string s when s.Contains("data 701") => "Account expired. Please contact your administrator.",
                string s when s.Contains("data 773") => "Password must be reset. Please update your password.",
                string s when s.Contains("data 775") => "Your AD account is locked. Please try again later.",
                _ => $"Authentication failed, please check your username and password, or contact support."
            },
            _ => "LDAP server internal error: please contact support.",
        };
        throw new AuthenticationException(message, ex);
    }
    catch
    {
        throw;
    }
}

可行解决办法 #

1. 升级.NET Runtime版本

该问题已在后续的.NET版本中被修复，建议升级到.NET 7及以上的稳定版本。升级后，ServerErrorMessage字段会在Linux系统中正常返回LDAP服务器的详细错误信息。

2. 切换到第三方LDAP库

如果暂时无法升级.NET版本，可以使用跨平台兼容性更好的第三方LDAP库，比如Novell.Directory.Ldap.NETStandard。该库在Linux下能稳定获取详细错误信息，示例代码如下：

首先通过NuGet安装包：Install-Package Novell.Directory.Ldap.NETStandard

修改后的认证逻辑：

using Novell.Directory.Ldap;

public void Authenticate(string username, string password)
{
    var ldapUsername = $"{username}@{_ldapDomain}"; // 使用UPN格式或DN格式
    int ldapPort = _ldapPort;
    bool useSsl = _ldapPort == 636; // 根据端口判断是否启用SSL

    using var connection = new LdapConnection();
    connection.Connect(_ldapServer, ldapPort);
    if (useSsl)
    {
        connection.StartTls();
    }

    try
    {
        connection.Bind(LdapConnection.LdapV3, ldapUsername, password);
    }
    catch (LdapException ex)
    {
        string message = ex.ResultCode switch
        {
            49 => ex.Message switch
            {
                string s when s.Contains("data 525") => "用户不存在，请检查用户名。",
                string s when s.Contains("data 52e") => "AD认证失败，请检查用户名和密码。",
                string s when s.Contains("data 530") => "当前时间不允许登录，请联系管理员。",
                string s when s.Contains("data 531") => "不允许从此工作站登录，请联系管理员。",
                string s when s.Contains("data 532") => "密码已过期，请更新密码。",
                string s when s.Contains("data 533") => "账户已禁用，请联系管理员。",
                string s when s.Contains("data 534") => "登录需要安全连接，请确保使用安全连接后重试。",
                string s when s.Contains("data 701") => "账户已过期，请联系管理员。",
                string s when s.Contains("data 773") => "必须重置密码，请更新密码。",
                string s when s.Contains("data 775") => "AD账户已锁定，请稍后重试。",
                _ => "认证失败，请检查用户名和密码，或联系支持人员。"
            },
            _ => "LDAP服务器内部错误，请联系支持人员。"
        };
        throw new AuthenticationException(message, ex);
    }
    finally
    {
        if (connection.Connected)
        {
            connection.Disconnect();
        }
    }
}

3. 手动解析错误信息（临时方案）

如果既不能升级.NET也不想换库，可以尝试从LdapException的ExtendedErrorMessage字段或Data集合提取信息，作为临时应急方案：

catch (LdapException ex)
{
    string errorDetails = string.Empty;
    // 尝试从ExtendedErrorMessage获取
    if (!string.IsNullOrEmpty(ex.ExtendedErrorMessage))
    {
        errorDetails = ex.ExtendedErrorMessage;
    }
    // 尝试从Data集合提取底层错误
    else if (ex.Data.Contains("ErrorMessage"))
    {
        errorDetails = ex.Data["ErrorMessage"]?.ToString() ?? string.Empty;
    }

    var message = ex.ErrorCode switch
    {
        49 => errorDetails switch
        {
            string s when s.Contains("data 525") => "用户不存在，请检查用户名。",
            string s when s.Contains("data 52e") => "AD认证失败，请检查用户名和密码。",
            // 其余分支保持原逻辑
            _ => "认证失败，请检查用户名和密码，或联系支持人员。"
        },
        _ => "LDAP服务器内部错误，请联系支持人员。"
    };
    throw new AuthenticationException(message, ex);
}

内容的提问来源于stack exchange，提问作者Lan Lin