use of org.ldaptive.auth.ext.PasswordPolicyAuthenticationRequestHandler in project cas by apereo.
the class LdapUtils method createLdapPasswordPolicyConfiguration.
/**
* Create ldap password policy configuration.
*
* @param passwordPolicy the password policy
* @param authenticator the authenticator
* @param attributes the attributes
* @return the password policy context
*/
public static PasswordPolicyContext createLdapPasswordPolicyConfiguration(final LdapPasswordPolicyProperties passwordPolicy, final Authenticator authenticator, final Multimap<String, Object> attributes) {
val cfg = new PasswordPolicyContext(passwordPolicy);
val requestHandlers = new HashSet<>();
val responseHandlers = new HashSet<>();
val customPolicyClass = passwordPolicy.getCustomPolicyClass();
if (StringUtils.isNotBlank(customPolicyClass)) {
try {
LOGGER.debug("Configuration indicates use of a custom password policy handler [{}]", customPolicyClass);
val clazz = (Class<AuthenticationResponseHandler>) Class.forName(customPolicyClass);
responseHandlers.add(clazz.getDeclaredConstructor().newInstance());
} catch (final Exception e) {
LoggingUtils.warn(LOGGER, "Unable to construct an instance of the password policy handler", e);
}
}
LOGGER.debug("Password policy authentication response handler is set to accommodate directory type: [{}]", passwordPolicy.getType());
switch(passwordPolicy.getType()) {
case AD:
responseHandlers.add(new ActiveDirectoryAuthenticationResponseHandler(Period.ofDays(cfg.getPasswordWarningNumberOfDays())));
Arrays.stream(ActiveDirectoryAuthenticationResponseHandler.ATTRIBUTES).forEach(a -> {
LOGGER.debug("Configuring authentication to retrieve password policy attribute [{}]", a);
attributes.put(a, a);
});
break;
case FreeIPA:
Arrays.stream(FreeIPAAuthenticationResponseHandler.ATTRIBUTES).forEach(a -> {
LOGGER.debug("Configuring authentication to retrieve password policy attribute [{}]", a);
attributes.put(a, a);
});
responseHandlers.add(new FreeIPAAuthenticationResponseHandler(Period.ofDays(cfg.getPasswordWarningNumberOfDays()), cfg.getLoginFailures()));
break;
case EDirectory:
Arrays.stream(EDirectoryAuthenticationResponseHandler.ATTRIBUTES).forEach(a -> {
LOGGER.debug("Configuring authentication to retrieve password policy attribute [{}]", a);
attributes.put(a, a);
});
responseHandlers.add(new EDirectoryAuthenticationResponseHandler(Period.ofDays(cfg.getPasswordWarningNumberOfDays())));
break;
default:
requestHandlers.add(new PasswordPolicyAuthenticationRequestHandler());
responseHandlers.add(new PasswordPolicyAuthenticationResponseHandler());
responseHandlers.add(new PasswordExpirationAuthenticationResponseHandler());
break;
}
if (!requestHandlers.isEmpty()) {
authenticator.setRequestHandlers(requestHandlers.toArray(AuthenticationRequestHandler[]::new));
}
authenticator.setResponseHandlers(responseHandlers.toArray(AuthenticationResponseHandler[]::new));
LOGGER.debug("LDAP authentication response handlers configured are: [{}]", responseHandlers);
if (!passwordPolicy.isAccountStateHandlingEnabled()) {
cfg.setAccountStateHandler((response, configuration) -> new ArrayList<>(0));
LOGGER.trace("Handling LDAP account states is disabled via CAS configuration");
} else if (StringUtils.isNotBlank(passwordPolicy.getWarningAttributeName()) && StringUtils.isNotBlank(passwordPolicy.getWarningAttributeValue())) {
val accountHandler = new OptionalWarningLdapAccountStateHandler();
accountHandler.setDisplayWarningOnMatch(passwordPolicy.isDisplayWarningOnMatch());
accountHandler.setWarnAttributeName(passwordPolicy.getWarningAttributeName());
accountHandler.setWarningAttributeValue(passwordPolicy.getWarningAttributeValue());
accountHandler.setAttributesToErrorMap(passwordPolicy.getPolicyAttributes());
cfg.setAccountStateHandler(accountHandler);
LOGGER.debug("Configuring an warning account state handler for LDAP authentication for warning attribute [{}] and value [{}]", passwordPolicy.getWarningAttributeName(), passwordPolicy.getWarningAttributeValue());
} else {
val accountHandler = new DefaultLdapAccountStateHandler();
accountHandler.setAttributesToErrorMap(passwordPolicy.getPolicyAttributes());
cfg.setAccountStateHandler(accountHandler);
LOGGER.debug("Configuring the default account state handler for LDAP authentication");
}
return cfg;
}
Aggregations