6031e9c7eb72435516a6828deb2e97533ed0382dludovicp/*
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp * CDDL HEADER START
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp *
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp * The contents of this file are subject to the terms of the
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp * Common Development and Distribution License, Version 1.0 only
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp * (the "License"). You may not use this file except in compliance
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp * with the License.
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp *
8cf870d281dc8c242f083d14dfef05f24aa5fceeJnRouvignac * You can obtain a copy of the license at legal-notices/CDDLv1_0.txt
8cf870d281dc8c242f083d14dfef05f24aa5fceeJnRouvignac * or http://forgerock.org/license/CDDLv1.0.html.
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp * See the License for the specific language governing permissions
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp * and limitations under the License.
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp *
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp * When distributing Covered Code, include this CDDL HEADER in each
8cf870d281dc8c242f083d14dfef05f24aa5fceeJnRouvignac * file and include the License file at legal-notices/CDDLv1_0.txt.
8cf870d281dc8c242f083d14dfef05f24aa5fceeJnRouvignac * If applicable, add the following below this CDDL HEADER, with the
8cf870d281dc8c242f083d14dfef05f24aa5fceeJnRouvignac * fields enclosed by brackets "[]" replaced with your own identifying
8cf870d281dc8c242f083d14dfef05f24aa5fceeJnRouvignac * information:
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp * Portions Copyright [yyyy] [name of copyright owner]
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp *
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp * CDDL HEADER END
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp *
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp *
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp * Copyright 2010 Sun Microsystems, Inc.
5870da55253783e663b28e5c695572f604a1aebfJnRouvignac * Portions copyright 2011-2013 ForgeRock AS.
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp */
6031e9c7eb72435516a6828deb2e97533ed0382dludovicppackage org.opends.server.extensions;
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp
c62ea3409a40a47983d62cad2f8476578f8ee664matthewimport java.util.Collections;
6031e9c7eb72435516a6828deb2e97533ed0382dludovicpimport java.util.Set;
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp
6031e9c7eb72435516a6828deb2e97533ed0382dludovicpimport org.opends.messages.Message;
6031e9c7eb72435516a6828deb2e97533ed0382dludovicpimport org.opends.server.admin.std.server.
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp PasswordPolicySubentryVirtualAttributeCfg;
3bfde8a324ef1dc0d757a9a34007cdb15018dc9amatthewimport org.opends.server.api.AuthenticationPolicy;
6031e9c7eb72435516a6828deb2e97533ed0382dludovicpimport org.opends.server.api.VirtualAttributeProvider;
6031e9c7eb72435516a6828deb2e97533ed0382dludovicpimport org.opends.server.core.DirectoryServer;
6031e9c7eb72435516a6828deb2e97533ed0382dludovicpimport org.opends.server.core.SearchOperation;
6031e9c7eb72435516a6828deb2e97533ed0382dludovicpimport org.opends.server.loggers.ErrorLogger;
6031e9c7eb72435516a6828deb2e97533ed0382dludovicpimport org.opends.server.loggers.debug.DebugTracer;
6031e9c7eb72435516a6828deb2e97533ed0382dludovicpimport org.opends.server.types.*;
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp
6031e9c7eb72435516a6828deb2e97533ed0382dludovicpimport static org.opends.messages.ExtensionMessages.*;
6031e9c7eb72435516a6828deb2e97533ed0382dludovicpimport static org.opends.server.loggers.debug.DebugLogger.*;
6031e9c7eb72435516a6828deb2e97533ed0382dludovicpimport static org.opends.server.util.StaticUtils.*;
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp/**
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp * This class implements a virtual attribute provider to serve
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp * the pwdPolicySubentry operational attribute as described in
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp * Password Policy for LDAP Directories Internet-Draft.
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp */
6031e9c7eb72435516a6828deb2e97533ed0382dludovicppublic class PasswordPolicySubentryVirtualAttributeProvider
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp extends VirtualAttributeProvider<
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp PasswordPolicySubentryVirtualAttributeCfg>
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp{
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp /**
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp * The tracer object for the debug logger.
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp */
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp private static final DebugTracer TRACER = getTracer();
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp /**
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp * Creates a new instance of this pwdPolicySubentry
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp * virtual attribute provider.
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp */
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp public PasswordPolicySubentryVirtualAttributeProvider()
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp {
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp super();
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp // All initialization should be performed in the
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp // initializeVirtualAttributeProvider method.
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp }
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp
5870da55253783e663b28e5c695572f604a1aebfJnRouvignac /** {@inheritDoc} */
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp @Override()
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp public boolean isMultiValued()
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp {
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp return false;
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp }
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp
5870da55253783e663b28e5c695572f604a1aebfJnRouvignac /** {@inheritDoc} */
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp @Override()
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp public Set<AttributeValue> getValues(Entry entry,
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp VirtualAttributeRule rule)
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp {
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp if (!entry.isSubentry() && !entry.isLDAPSubentry())
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp {
3bfde8a324ef1dc0d757a9a34007cdb15018dc9amatthew AuthenticationPolicy policy = null;
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp try
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp {
3bfde8a324ef1dc0d757a9a34007cdb15018dc9amatthew policy = AuthenticationPolicy.forUser(entry, false);
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp }
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp catch (DirectoryException de)
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp {
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp // Something went wrong while trying to
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp // retrieve password policy, log this.
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp ErrorLogger.logError(de.getMessageObject());
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp if (debugEnabled())
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp {
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp TRACER.debugError("Failed to retrieve password " +
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp "policy for user %s: %s",
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp entry.getDN().toString(),
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp stackTraceToSingleLineString(de));
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp }
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp }
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp
c62ea3409a40a47983d62cad2f8476578f8ee664matthew if (policy == null)
c62ea3409a40a47983d62cad2f8476578f8ee664matthew {
c62ea3409a40a47983d62cad2f8476578f8ee664matthew // No authentication policy: debug log this as an error since all
c62ea3409a40a47983d62cad2f8476578f8ee664matthew // entries should have at least the default password policy.
c62ea3409a40a47983d62cad2f8476578f8ee664matthew if (debugEnabled())
c62ea3409a40a47983d62cad2f8476578f8ee664matthew {
c62ea3409a40a47983d62cad2f8476578f8ee664matthew TRACER.debugError("No applicable password policy for user %s", entry
c62ea3409a40a47983d62cad2f8476578f8ee664matthew .getDN().toString());
c62ea3409a40a47983d62cad2f8476578f8ee664matthew }
c62ea3409a40a47983d62cad2f8476578f8ee664matthew }
c62ea3409a40a47983d62cad2f8476578f8ee664matthew else if (policy.isPasswordPolicy())
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp {
c62ea3409a40a47983d62cad2f8476578f8ee664matthew AttributeType dnAttrType = DirectoryServer
c62ea3409a40a47983d62cad2f8476578f8ee664matthew .getAttributeType("1.3.6.1.4.1.42.2.27.8.1.23");
f43bf60164dfc1ac60e5332f7a17ca1425c88268matthew DN policyDN = policy.getDN();
c62ea3409a40a47983d62cad2f8476578f8ee664matthew AttributeValue value = AttributeValues.create(dnAttrType,
c62ea3409a40a47983d62cad2f8476578f8ee664matthew policyDN.toString());
c62ea3409a40a47983d62cad2f8476578f8ee664matthew return Collections.singleton(value);
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp }
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp else
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp {
c62ea3409a40a47983d62cad2f8476578f8ee664matthew // Not a password policy, could be PTA, etc.
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp if (debugEnabled())
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp {
c62ea3409a40a47983d62cad2f8476578f8ee664matthew TRACER.debugVerbose("Authentication policy %s found for user %s is "
c62ea3409a40a47983d62cad2f8476578f8ee664matthew + "not a password policy", policy.getDN().toString(), entry
c62ea3409a40a47983d62cad2f8476578f8ee664matthew .getDN().toString());
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp }
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp }
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp }
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp
c62ea3409a40a47983d62cad2f8476578f8ee664matthew return Collections.emptySet();
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp }
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp
5870da55253783e663b28e5c695572f604a1aebfJnRouvignac /** {@inheritDoc} */
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp @Override()
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp public boolean isSearchable(VirtualAttributeRule rule,
1213c76646ee52dee5230cb219a7af951e8433b9ludo SearchOperation searchOperation,
1213c76646ee52dee5230cb219a7af951e8433b9ludo boolean isPreIndexed)
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp {
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp return false;
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp }
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp
5870da55253783e663b28e5c695572f604a1aebfJnRouvignac /** {@inheritDoc} */
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp @Override()
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp public void processSearch(VirtualAttributeRule rule,
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp SearchOperation searchOperation)
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp {
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp searchOperation.setResultCode(ResultCode.UNWILLING_TO_PERFORM);
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp Message message =
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp ERR_PASSWORDPOLICYSUBENTRY_VATTR_NOT_SEARCHABLE.get(
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp rule.getAttributeType().getNameOrOID());
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp searchOperation.appendErrorMessage(message);
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp }
6031e9c7eb72435516a6828deb2e97533ed0382dludovicp}