Luke Taylor
20 years ago
4 changed files with 574 additions and 0 deletions
@ -0,0 +1,68 @@
@@ -0,0 +1,68 @@
|
||||
package org.acegisecurity.providers.ldap.authenticator.controls; |
||||
|
||||
import javax.naming.ldap.Control; |
||||
|
||||
/** |
||||
* A Password Policy request control. |
||||
* <p> |
||||
* Based on the information in the corresponding internet draft on |
||||
* LDAP password policy. |
||||
* </p> |
||||
* |
||||
* @see PasswordPolicyResponseControl |
||||
* @see <a href="http://www.ietf.org/internet-drafts/draft-behera-ldap-password-policy-09.txt">Password Policy for LDAP Directories</a> |
||||
* |
||||
* @author Stefan Zoerner |
||||
* @author Luke Taylor |
||||
* |
||||
* @version $Id$ |
||||
* |
||||
*/ |
||||
public class PasswordPolicyControl implements Control { |
||||
|
||||
/** OID of the Password Policy Control */ |
||||
public static final String OID = "1.3.6.1.4.1.42.2.27.8.5.1"; |
||||
|
||||
private boolean critical; |
||||
|
||||
/** |
||||
* Creates a non-critical (request) control. |
||||
*/ |
||||
public PasswordPolicyControl() { |
||||
this(Control.NONCRITICAL); |
||||
} |
||||
|
||||
/** |
||||
* Creates a (request) control. |
||||
* |
||||
* @param critical indicates whether the control is |
||||
* critical for the client |
||||
*/ |
||||
public PasswordPolicyControl(boolean critical) { |
||||
this.critical = critical; |
||||
} |
||||
|
||||
/** |
||||
* Returns the OID of the Password Policy Control. |
||||
*/ |
||||
public String getID() { |
||||
return OID; |
||||
} |
||||
|
||||
/** |
||||
* Returns whether the control is critical for the client. |
||||
*/ |
||||
public boolean isCritical() { |
||||
return critical; |
||||
} |
||||
|
||||
/** |
||||
* Retrieves the ASN.1 BER encoded value of the LDAP control. The request |
||||
* value for this control is always empty. |
||||
* |
||||
* @return always null |
||||
*/ |
||||
public byte[] getEncodedValue() { |
||||
return null; |
||||
} |
||||
} |
||||
@ -0,0 +1,35 @@
@@ -0,0 +1,35 @@
|
||||
package org.acegisecurity.providers.ldap.authenticator.controls; |
||||
|
||||
import java.io.ByteArrayInputStream; |
||||
import java.io.IOException; |
||||
|
||||
import javax.naming.ldap.Control; |
||||
import javax.naming.ldap.ControlFactory; |
||||
|
||||
/** |
||||
* Transforms a control object to a PasswordPolicyResponseControl object, if |
||||
* appropriate. |
||||
* |
||||
* @author Stefan Zoerner |
||||
* @author Luke Taylor |
||||
* @version $Id$ |
||||
*/ |
||||
public class PasswordPolicyControlFactory extends ControlFactory { |
||||
|
||||
/** |
||||
* Creates an instance of PasswordPolicyResponseControl if the passed |
||||
* control is a response control of this type. Attributes of the result are |
||||
* filled with the correct values (e.g. error code). |
||||
* |
||||
* @param ctl the control the check |
||||
* @return a response control of type PasswordPolicyResponseControl, or null |
||||
*/ |
||||
public Control getControlInstance(Control ctl) { |
||||
|
||||
if (ctl.getID().equals(PasswordPolicyControl.OID)) { |
||||
return new PasswordPolicyResponseControl(ctl.getEncodedValue()); |
||||
} |
||||
|
||||
return null; |
||||
} |
||||
} |
||||
@ -0,0 +1,358 @@
@@ -0,0 +1,358 @@
|
||||
package org.acegisecurity.providers.ldap.authenticator.controls; |
||||
|
||||
|
||||
import java.io.IOException; |
||||
import java.io.ByteArrayInputStream; |
||||
import java.io.InputStream; |
||||
|
||||
import org.acegisecurity.providers.ldap.LdapDataAccessException; |
||||
import org.apache.commons.logging.Log; |
||||
import org.apache.commons.logging.LogFactory; |
||||
|
||||
//import com.novell.ldap.asn1.LBERDecoder;
|
||||
//import com.novell.ldap.asn1.ASN1Sequence;
|
||||
//import com.novell.ldap.asn1.ASN1Tagged;
|
||||
//import com.novell.ldap.asn1.ASN1OctetString;
|
||||
import netscape.ldap.ber.stream.BERSequence; |
||||
import netscape.ldap.ber.stream.BERElement; |
||||
import netscape.ldap.ber.stream.BERTagDecoder; |
||||
import netscape.ldap.ber.stream.BERTag; |
||||
import netscape.ldap.ber.stream.BERChoice; |
||||
import netscape.ldap.ber.stream.BERInteger; |
||||
import netscape.ldap.ber.stream.BEREnumerated; |
||||
|
||||
/** |
||||
* Represent the response control received when a <tt>PasswordPolicyControl</tt> |
||||
* is used when binding to a directory. |
||||
* |
||||
* Currently tested with the OpenLDAP 2.3.19 implementation of the LDAP Password |
||||
* Policy Draft. |
||||
* |
||||
* It extends the request control with the control specific data. This is |
||||
* accomplished by the properties timeBeforeExpiration, graceLoginsRemaining and |
||||
* errorCodes. getEncodedValue returns the |
||||
* unchanged value of the response control as a byte array. |
||||
* |
||||
* @see PasswordPolicyControl |
||||
* @see <a href="http://www.ibm.com/developerworks/tivoli/library/t-ldap-controls/">Stefan Zoerner's IBM developerworks article on LDAP controls.</a> |
||||
* |
||||
* @author Stefan Zoerner |
||||
* @author Luke Taylor |
||||
* @version $Id$ |
||||
*/ |
||||
public class PasswordPolicyResponseControl extends PasswordPolicyControl { |
||||
|
||||
private static final Log logger = LogFactory.getLog(PasswordPolicyResponseControl.class); |
||||
|
||||
public static final int ERROR_NONE = -1; |
||||
|
||||
public static final int ERROR_PASSWORD_EXPIRED = 0; |
||||
public static final int ERROR_ACCOUNT_LOCKED = 1; |
||||
|
||||
public static final int WARNINGS_DEFAULT = -1; |
||||
|
||||
private byte[] encodedValue; |
||||
|
||||
private int errorCode = ERROR_NONE; |
||||
|
||||
private int timeBeforeExpiration = WARNINGS_DEFAULT; |
||||
|
||||
private int graceLoginsRemaining = WARNINGS_DEFAULT; |
||||
|
||||
private static final String[] errorText = { "password expired", "account locked", |
||||
"change after reset", "password mod not allowed", "must supply old password", |
||||
"invalid password syntax", "password too short", "password too young", |
||||
"password in history" }; |
||||
|
||||
public PasswordPolicyResponseControl(byte[] encodedValue) { |
||||
this.encodedValue = encodedValue; |
||||
|
||||
//PPolicyDecoder decoder = new JLdapDecoder();
|
||||
PPolicyDecoder decoder = new NetscapeDecoder(); |
||||
|
||||
try { |
||||
decoder.decode(); |
||||
} catch (IOException e) { |
||||
throw new LdapDataAccessException("Failed to parse control value", e); |
||||
} |
||||
} |
||||
|
||||
/** |
||||
* Decodes the Ber encoded control data. |
||||
* |
||||
* The ASN.1 value of the control data is: |
||||
* |
||||
* <pre> |
||||
* PasswordPolicyResponseValue ::= SEQUENCE { |
||||
* warning [0] CHOICE { |
||||
* timeBeforeExpiration [0] INTEGER (0 .. maxInt), |
||||
* graceAuthNsRemaining [1] INTEGER (0 .. maxInt) } OPTIONAL, |
||||
* error [1] ENUMERATED { |
||||
* passwordExpired (0), |
||||
* accountLocked (1), |
||||
* changeAfterReset (2), |
||||
* passwordModNotAllowed (3), |
||||
* mustSupplyOldPassword (4), |
||||
* insufficientPasswordQuality (5), |
||||
* passwordTooShort (6), |
||||
* passwordTooYoung (7), |
||||
* passwordInHistory (8) } OPTIONAL } |
||||
* </pre> |
||||
* |
||||
*/ |
||||
|
||||
|
||||
/** |
||||
* Returns the graceLoginsRemaining. |
||||
* |
||||
* @return Returns the graceLoginsRemaining. |
||||
*/ |
||||
public int getGraceLoginsRemaining() { |
||||
return graceLoginsRemaining; |
||||
} |
||||
|
||||
/** |
||||
* Returns the timeBeforeExpiration. |
||||
* |
||||
* @return Returns the time before expiration in seconds |
||||
*/ |
||||
public int getTimeBeforeExpiration() { |
||||
return timeBeforeExpiration; |
||||
} |
||||
|
||||
/** |
||||
* Returns the unchanged value of the response control. |
||||
* |
||||
* Returns the unchanged value of the response control as byte array. |
||||
*/ |
||||
public byte[] getEncodedValue() { |
||||
return encodedValue; |
||||
} |
||||
|
||||
/** |
||||
* Returns the error code, or ERROR_NONE, if no error is present. |
||||
* |
||||
* @return the error code (0-8), or ERROR_NONE |
||||
*/ |
||||
public int getErrorCode() { |
||||
return errorCode; |
||||
} |
||||
|
||||
/** |
||||
* Checks whether an error is present. |
||||
* |
||||
* @return true, if an error is present |
||||
*/ |
||||
public boolean hasError() { |
||||
return this.getErrorCode() != ERROR_NONE; |
||||
} |
||||
|
||||
/** |
||||
* Checks whether a warning is present. |
||||
* |
||||
* @return true, if a warning is present |
||||
*/ |
||||
public boolean hasWarning() { |
||||
return graceLoginsRemaining != WARNINGS_DEFAULT |
||||
|| timeBeforeExpiration != WARNINGS_DEFAULT; |
||||
} |
||||
|
||||
public boolean isExpired() { |
||||
return errorCode == ERROR_PASSWORD_EXPIRED; |
||||
} |
||||
|
||||
/** |
||||
* Determines whether an account locked error has |
||||
* been returned. |
||||
* |
||||
* @return true if the account is locked. |
||||
*/ |
||||
public boolean isLocked() { |
||||
return errorCode == ERROR_ACCOUNT_LOCKED; |
||||
} |
||||
|
||||
/** |
||||
* Create a textual representation containing error and warning messages, if |
||||
* any are present. |
||||
* |
||||
* @return error and warning messages |
||||
*/ |
||||
public String toString() { |
||||
|
||||
StringBuffer sb = new StringBuffer("PasswordPolicyResponseControl"); |
||||
|
||||
if (hasError()) { |
||||
sb.append(", error: ").append(errorText[errorCode]); |
||||
} |
||||
if (graceLoginsRemaining != WARNINGS_DEFAULT) { |
||||
sb.append(", warning: ").append(graceLoginsRemaining).append(" grace logins remain"); |
||||
} |
||||
if (timeBeforeExpiration != WARNINGS_DEFAULT) { |
||||
sb.append(", warning: time before expiration is ").append(timeBeforeExpiration); |
||||
} |
||||
if (!hasError() && !hasWarning()) { |
||||
sb.append(" (no error, no warning)"); |
||||
} |
||||
|
||||
return sb.toString(); |
||||
} |
||||
|
||||
//~ Inner Classes =========================================================
|
||||
|
||||
private interface PPolicyDecoder { |
||||
void decode() throws IOException; |
||||
} |
||||
|
||||
/** Decoder based on Netscape ldapsdk library */ |
||||
private class NetscapeDecoder implements PPolicyDecoder { |
||||
|
||||
public void decode() throws IOException { |
||||
int[] bread = { 0 }; |
||||
BERSequence seq = (BERSequence) BERElement.getElement( |
||||
new SpecificTagDecoder(), new ByteArrayInputStream(encodedValue), bread); |
||||
|
||||
int size = seq.size(); |
||||
|
||||
if(logger.isDebugEnabled()) { |
||||
logger.debug("PasswordPolicyResponse, ASN.1 sequence has " + |
||||
size + " elements"); |
||||
} |
||||
|
||||
for (int i = 0; i < seq.size(); i++) { |
||||
BERTag elt = (BERTag)seq.elementAt(i); |
||||
|
||||
int tag = elt.getTag() & 0x1F; |
||||
|
||||
if(tag == 0) { |
||||
BERChoice warning = (BERChoice)elt.getValue(); |
||||
|
||||
BERTag content = (BERTag)warning.getValue(); |
||||
int value = ((BERInteger)content.getValue()).getValue(); |
||||
|
||||
if((content.getTag() & 0x1F) == 0) { |
||||
timeBeforeExpiration = value; |
||||
} else { |
||||
graceLoginsRemaining = value; |
||||
} |
||||
} else if(tag == 1) { |
||||
BEREnumerated error = (BEREnumerated)elt.getValue(); |
||||
errorCode = error.getValue(); |
||||
} |
||||
} |
||||
|
||||
} |
||||
|
||||
class SpecificTagDecoder extends BERTagDecoder { |
||||
/** Allows us to remember which of the two options we're decoding */ |
||||
private Boolean inChoice = null; |
||||
|
||||
public BERElement getElement(BERTagDecoder decoder, int tag, InputStream stream, |
||||
int[] bytesRead, boolean[] implicit) throws IOException { |
||||
|
||||
tag &= 0x1F; |
||||
implicit[0] = false; |
||||
|
||||
if(tag == 0) { |
||||
// Either the choice or the time before expiry within it
|
||||
if(inChoice == null) { |
||||
setInChoice(true); |
||||
|
||||
// Read the choice length from the stream (ignored)
|
||||
BERElement.readLengthOctets(stream, bytesRead); |
||||
|
||||
int[] componentLength = new int[1]; |
||||
BERElement choice = new BERChoice(decoder, stream, componentLength); |
||||
bytesRead[0] += componentLength[0]; |
||||
|
||||
// inChoice = null;
|
||||
return choice; |
||||
} else { |
||||
// Must be time before expiry
|
||||
return new BERInteger(stream, bytesRead); |
||||
} |
||||
} else if(tag == 1) { |
||||
// Either the graceLogins or the error enumeration.
|
||||
if(inChoice == null) { |
||||
// The enumeration
|
||||
setInChoice(false); |
||||
|
||||
return new BEREnumerated(stream, bytesRead); |
||||
|
||||
} else { |
||||
if(inChoice.booleanValue()) { |
||||
// graceLogins
|
||||
return new BERInteger(stream, bytesRead); |
||||
} |
||||
} |
||||
} |
||||
|
||||
throw new LdapDataAccessException("Unexpected tag " + tag); |
||||
} |
||||
|
||||
private void setInChoice(boolean inChoice) { |
||||
this.inChoice = new Boolean(inChoice); |
||||
} |
||||
} |
||||
} |
||||
|
||||
/** Decoder based on the OpenLDAP/Novell JLDAP library */ |
||||
// private class JLdapDecoder implements PPolicyDecoder {
|
||||
//
|
||||
// public void decode() throws IOException {
|
||||
//
|
||||
// LBERDecoder decoder = new LBERDecoder();
|
||||
//
|
||||
// ASN1Sequence seq = (ASN1Sequence)decoder.decode(encodedValue);
|
||||
//
|
||||
// if(seq == null) {
|
||||
//
|
||||
// }
|
||||
//
|
||||
// int size = seq.size();
|
||||
//
|
||||
// if(logger.isDebugEnabled()) {
|
||||
// logger.debug("PasswordPolicyResponse, ASN.1 sequence has " +
|
||||
// size + " elements");
|
||||
// }
|
||||
//
|
||||
// for(int i=0; i < size; i++) {
|
||||
//
|
||||
// ASN1Tagged taggedObject = (ASN1Tagged)seq.get(i);
|
||||
//
|
||||
// int tag = taggedObject.getIdentifier().getTag();
|
||||
//
|
||||
// ASN1OctetString value = (ASN1OctetString)taggedObject.taggedValue();
|
||||
// byte[] content = value.byteValue();
|
||||
//
|
||||
// if(tag == 0) {
|
||||
// parseWarning(content, decoder);
|
||||
//
|
||||
// } else if(tag == 1) {
|
||||
// // Error: set the code to the value
|
||||
// errorCode = content[0];
|
||||
// }
|
||||
// }
|
||||
// }
|
||||
//
|
||||
// private void parseWarning(byte[] content, LBERDecoder decoder) {
|
||||
// // It's the warning (choice). Parse the number and set either the
|
||||
// // expiry time or number of logins remaining.
|
||||
// ASN1Tagged taggedObject = (ASN1Tagged)decoder.decode(content);
|
||||
// int contentTag = taggedObject.getIdentifier().getTag();
|
||||
// content = ((ASN1OctetString)taggedObject.taggedValue()).byteValue();
|
||||
// int number;
|
||||
//
|
||||
// try {
|
||||
// number = ((Long)decoder.decodeNumeric(new ByteArrayInputStream(content), content.length)).intValue();
|
||||
// } catch(IOException e) {
|
||||
// throw new LdapDataAccessException("Failed to parse number ", e);
|
||||
// }
|
||||
//
|
||||
// if(contentTag == 0) {
|
||||
// timeBeforeExpiration = number;
|
||||
// } else if (contentTag == 1) {
|
||||
// graceLoginsRemaining = number;
|
||||
// }
|
||||
// }
|
||||
// }
|
||||
} |
||||
@ -0,0 +1,113 @@
@@ -0,0 +1,113 @@
|
||||
package org.acegisecurity.providers.ldap.authenticator.controls; |
||||
|
||||
import junit.framework.TestCase; |
||||
|
||||
import javax.naming.Context; |
||||
import javax.naming.NamingException; |
||||
import javax.naming.ldap.Control; |
||||
import javax.naming.ldap.InitialLdapContext; |
||||
import javax.naming.ldap.LdapContext; |
||||
import java.util.Hashtable; |
||||
|
||||
|
||||
/** |
||||
* Tests for <tt>PasswordPolicyResponse</tt>. |
||||
* |
||||
* @author Luke Taylor |
||||
* @version $Id$ |
||||
*/ |
||||
public class PasswordPolicyResponseControlTests extends TestCase { |
||||
|
||||
/** Useful method for obtaining data from a server for use in tests */ |
||||
// public void testAgainstServer() throws Exception {
|
||||
// Hashtable env = new Hashtable();
|
||||
// env.put(Context.INITIAL_CONTEXT_FACTORY, "com.sun.jndi.ldap.LdapCtxFactory");
|
||||
// env.put(Context.PROVIDER_URL, "ldap://gorille:389/");
|
||||
// env.put(Context.SECURITY_AUTHENTICATION, "simple");
|
||||
// env.put(Context.SECURITY_PRINCIPAL, "cn=manager,dc=acegisecurity,dc=org");
|
||||
// env.put(Context.SECURITY_CREDENTIALS, "acegisecurity");
|
||||
//
|
||||
// InitialLdapContext ctx = new InitialLdapContext(env, null);
|
||||
//
|
||||
// Control[] rctls = { new PasswordPolicyControl(false) };
|
||||
//
|
||||
//
|
||||
// try {
|
||||
// ctx.addToEnvironment(LdapContext.CONTROL_FACTORIES, PasswordPolicyControlFactory.class.getName());
|
||||
// ctx.addToEnvironment(Context.SECURITY_PRINCIPAL, "uid=bob,ou=people,dc=acegisecurity,dc=org" );
|
||||
// ctx.addToEnvironment(Context.SECURITY_CREDENTIALS, "bobspassword");
|
||||
// ctx.reconnect(rctls);
|
||||
// } catch(NamingException ne) {
|
||||
// // Ok.
|
||||
// }
|
||||
//
|
||||
// PasswordPolicyResponseControl ctrl = getPPolicyResponseCtl(ctx);
|
||||
// System.out.println(ctrl);
|
||||
//
|
||||
// assertNotNull(ctrl);
|
||||
//
|
||||
// //com.sun.jndi.ldap.LdapPoolManager.showStats(System.out);
|
||||
// }
|
||||
|
||||
// private PasswordPolicyResponseControl getPPolicyResponseCtl(InitialLdapContext ctx) throws NamingException {
|
||||
// Control[] ctrls = ctx.getResponseControls();
|
||||
//
|
||||
// for (int i = 0; ctrls != null && i < ctrls.length; i++) {
|
||||
// if (ctrls[i] instanceof PasswordPolicyResponseControl) {
|
||||
// return (PasswordPolicyResponseControl) ctrls[i];
|
||||
// }
|
||||
// }
|
||||
//
|
||||
// return null;
|
||||
// }
|
||||
|
||||
|
||||
public void testOpenLDAP33SecondsTillPasswordExpiryCtrlIsParsedCorrectly() { |
||||
byte[] ctrlBytes = {0x30, 0x05, (byte)0xA0, 0x03, (byte)0xA0, 0x1, 0x21}; |
||||
|
||||
PasswordPolicyResponseControl ctrl = new PasswordPolicyResponseControl(ctrlBytes); |
||||
|
||||
assertTrue(ctrl.hasWarning()); |
||||
assertEquals(33, ctrl.getTimeBeforeExpiration()); |
||||
|
||||
} |
||||
|
||||
public void testOpenLDAPPasswordExpiredCtrlIsParsedCorrectly() { |
||||
byte[] ctrlBytes = {0x30, 0x03, (byte)0xA1, 0x01, 0x00}; |
||||
|
||||
PasswordPolicyResponseControl ctrl = new PasswordPolicyResponseControl(ctrlBytes); |
||||
|
||||
assertTrue(ctrl.hasError() && ctrl.isExpired()); |
||||
assertFalse(ctrl.hasWarning()); |
||||
|
||||
} |
||||
|
||||
public void testOpenLDAPAccountLockedCtrlIsParsedCorrectly() { |
||||
byte[] ctrlBytes = {0x30, 0x03, (byte)0xA1, 0x01, 0x01}; |
||||
|
||||
PasswordPolicyResponseControl ctrl = new PasswordPolicyResponseControl(ctrlBytes); |
||||
|
||||
assertTrue(ctrl.hasError() && ctrl.isLocked()); |
||||
assertFalse(ctrl.hasWarning()); |
||||
|
||||
} |
||||
|
||||
public void testOpenLDAP5GraceLoginsRemainingCtrlIsParsedCorrectly() { |
||||
byte[] ctrlBytes = {0x30, 0x05, (byte)0xA0, 0x03, (byte)0xA1, 0x01, 0x05}; |
||||
|
||||
PasswordPolicyResponseControl ctrl = new PasswordPolicyResponseControl(ctrlBytes); |
||||
|
||||
assertTrue(ctrl.hasWarning()); |
||||
assertEquals(5, ctrl.getGraceLoginsRemaining()); |
||||
} |
||||
|
||||
public void testOpenLDAP496GraceLoginsRemainingCtrlIsParsedCorrectly() { |
||||
byte[] ctrlBytes = {0x30, 0x06, (byte)0xA0, 0x04, (byte)0xA1, 0x02, 0x01, (byte)0xF0}; |
||||
|
||||
PasswordPolicyResponseControl ctrl = new PasswordPolicyResponseControl(ctrlBytes); |
||||
|
||||
assertTrue(ctrl.hasWarning()); |
||||
assertEquals(496, ctrl.getGraceLoginsRemaining()); |
||||
} |
||||
|
||||
} |
||||
Loading…
Reference in new issue