You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@directory.apache.org by el...@apache.org on 2023/08/15 22:46:19 UTC
[directory-server] 02/03: Preliminary work on PasswordPolicy refactoring
This is an automated email from the ASF dual-hosted git repository.
elecharny pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/directory-server.git
commit 7b824328a95f334bcc4d83b82c8d4b135b227a20
Author: emmanuel lecharny <el...@apache.org>
AuthorDate: Wed Aug 16 00:44:52 2023 +0200
Preliminary work on PasswordPolicy refactoring
---
.../server/core/ppolicy/PPolicyInterceptor.java | 397 ++++++++++++++++++++-
.../core/ppolicy/PpolicyConfigContainer.java | 113 ++++++
2 files changed, 509 insertions(+), 1 deletion(-)
diff --git a/interceptors/ppolicy/src/main/java/org/apache/directory/server/core/ppolicy/PPolicyInterceptor.java b/interceptors/ppolicy/src/main/java/org/apache/directory/server/core/ppolicy/PPolicyInterceptor.java
index 06635569a7..4d4b2e2eba 100644
--- a/interceptors/ppolicy/src/main/java/org/apache/directory/server/core/ppolicy/PPolicyInterceptor.java
+++ b/interceptors/ppolicy/src/main/java/org/apache/directory/server/core/ppolicy/PPolicyInterceptor.java
@@ -30,13 +30,36 @@ import static org.apache.directory.api.ldap.model.constants.PasswordPolicySchema
import static org.apache.directory.api.ldap.model.constants.PasswordPolicySchemaConstants.PWD_RESET_AT;
import static org.apache.directory.api.ldap.model.constants.PasswordPolicySchemaConstants.PWD_START_TIME_AT;
+import org.apache.directory.api.ldap.extras.controls.ppolicy.PasswordPolicyErrorEnum;
+import org.apache.directory.api.ldap.extras.controls.ppolicy.PasswordPolicyRequest;
+import org.apache.directory.api.ldap.extras.controls.ppolicy.PasswordPolicyResponse;
+import org.apache.directory.api.ldap.extras.controls.ppolicy.PasswordPolicyResponseImpl;
+import org.apache.directory.api.ldap.model.entry.Entry;
import org.apache.directory.api.ldap.model.exception.LdapException;
+import org.apache.directory.api.ldap.model.exception.LdapNoPermissionException;
+import org.apache.directory.api.ldap.model.message.MessageTypeEnum;
import org.apache.directory.api.ldap.model.schema.AttributeType;
+import org.apache.directory.server.core.api.CoreSession;
import org.apache.directory.server.core.api.DirectoryService;
import org.apache.directory.server.core.api.InterceptorEnum;
+import org.apache.directory.server.core.api.authn.ppolicy.PasswordPolicyConfiguration;
+import org.apache.directory.server.core.api.filtering.EntryFilteringCursor;
import org.apache.directory.server.core.api.interceptor.BaseInterceptor;
import org.apache.directory.server.core.api.interceptor.Interceptor;
+import org.apache.directory.server.core.api.interceptor.context.AddOperationContext;
+import org.apache.directory.server.core.api.interceptor.context.BindOperationContext;
+import org.apache.directory.server.core.api.interceptor.context.CompareOperationContext;
import org.apache.directory.server.core.api.interceptor.context.DeleteOperationContext;
+import org.apache.directory.server.core.api.interceptor.context.GetRootDseOperationContext;
+import org.apache.directory.server.core.api.interceptor.context.HasEntryOperationContext;
+import org.apache.directory.server.core.api.interceptor.context.LookupOperationContext;
+import org.apache.directory.server.core.api.interceptor.context.ModifyOperationContext;
+import org.apache.directory.server.core.api.interceptor.context.MoveAndRenameOperationContext;
+import org.apache.directory.server.core.api.interceptor.context.MoveOperationContext;
+import org.apache.directory.server.core.api.interceptor.context.OperationContext;
+import org.apache.directory.server.core.api.interceptor.context.RenameOperationContext;
+import org.apache.directory.server.core.api.interceptor.context.SearchOperationContext;
+import org.apache.directory.server.core.api.interceptor.context.UnbindOperationContext;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -48,7 +71,7 @@ import org.slf4j.LoggerFactory;
public class PPolicyInterceptor extends BaseInterceptor
{
private static final Logger LOG = LoggerFactory.getLogger( PPolicyInterceptor.class );
-
+
/**
* Speedup for logs
*/
@@ -75,6 +98,9 @@ public class PPolicyInterceptor extends BaseInterceptor
private AttributeType pwdEndTimeAT;
+ /** a container to hold all the ppolicies */
+// private PpolicyConfigContainer pwdPolicyContainer;
+
/**
* Creates a new instance of DefaultAuthorizationInterceptor.
@@ -139,6 +165,114 @@ public class PPolicyInterceptor extends BaseInterceptor
}
+ /**
+ * set all the password policies to be used by the server.
+ * This includes a default(i.e applicable to all entries) and custom(a.k.a per user) password policies
+ *
+ * @param policyContainer the container holding all the password policies
+ */
+// public void setPwdPolicies( PpolicyConfigContainer policyContainer )
+// {
+// this.pwdPolicyContainer = policyContainer;
+// }
+
+
+ /**
+ * {@inheritDoc}
+ */
+ @Override
+ public void add( AddOperationContext addContext ) throws LdapException
+ {
+ if ( IS_DEBUG )
+ {
+ LOG.debug( "Operation Context: {}", addContext );
+ }
+
+ // No need to do anythingh if the PasswordPoloicy is not activated,
+ // or if we are in a replication context
+ if ( !directoryService.isPwdPolicyEnabled() || addContext.isReplEvent() )
+ {
+ next( addContext );
+ return;
+ }
+
+ // First check if the entry is part of a PasswordPolicy subentry
+ Entry entry = addContext.getEntry();
+
+ PasswordPolicyConfiguration policyConfig = getPwdPolicy( entry, MessageTypeEnum.ADD_REQUEST );
+
+ if ( policyConfig == null )
+ {
+ // Simply call the next interceptor and return, there is nothing to do.
+ next( addContext );
+
+ return;
+ }
+
+ // At this point, the user requesting the addition has not been authenticated
+ // We just check what we do depending on the user requesting the addition, either an admin or a normal user
+/* if ( addContext.getSession().isAnAdministrator() )
+ {
+ // TODO
+ }
+ else
+ {
+ // TODO
+ }
+*/
+ // First check if the user's password reset is requested
+ checkPwdReset( addContext );
+
+ // We have three use cases:
+ // - The entry does not belong to an administrative area associated with a passwordPolicy in a subentry: nothing to do
+ // - The entry belongs to an administrative area associated with a passwordPolicy in a subentry, but has no attribute
+ // defined in the subentry pwdAttribute: nothing to do
+ // - The entry belongs to an administrative area associated with a passwordPolicy in a subentry, and has an attribute
+ // defined in the subentry pwdAttribute: add the requested operational attribute accordingly to the applied PasswordPolicy
+ //
+ // We can't discard an entry simply base don the fact that it does not have a userPassword attribute, it' snot enough.
+
+
+ // propagate the call to the next interceptor
+ next( addContext );
+ }
+
+
+ /**
+ * {@inheritDoc}
+ */
+ @Override
+ public void bind( BindOperationContext bindContext ) throws LdapException
+ {
+ if ( IS_DEBUG )
+ {
+ LOG.debug( "Operation Context: {}", bindContext );
+ }
+
+ // Operation check
+
+
+ // propagate the call to the next interceptor
+ next( bindContext );
+ }
+
+
+ /**
+ * {@inheritDoc}
+ */
+ @Override
+ public boolean compare( CompareOperationContext compareContext ) throws LdapException
+ {
+ if ( IS_DEBUG )
+ {
+ LOG.debug( "Operation Context: {}", compareContext );
+ }
+
+ // propagate the call to the next interceptor
+ return next( compareContext );
+ }
+
+
/**
* {@inheritDoc}
*/
@@ -155,4 +289,265 @@ public class PPolicyInterceptor extends BaseInterceptor
// propagate the call to the next interceptor
next( deleteContext );
}
+
+
+ /**
+ * {@inheritDoc}
+ */
+ @Override
+ public Entry getRootDse( GetRootDseOperationContext getRootDseContext ) throws LdapException
+ {
+ if ( IS_DEBUG )
+ {
+ LOG.debug( "Operation Context: {}", getRootDseContext );
+ }
+
+ // propagate the call to the next interceptor
+ return next( getRootDseContext );
+ }
+
+
+ /**
+ * {@inheritDoc}
+ */
+ @Override
+ public boolean hasEntry( HasEntryOperationContext hasEntryContext ) throws LdapException
+ {
+ if ( IS_DEBUG )
+ {
+ LOG.debug( "Operation Context: {}", hasEntryContext );
+ }
+
+ // propagate the call to the next interceptor
+ return next( hasEntryContext );
+ }
+
+
+ /**
+ * {@inheritDoc}
+ */
+ @Override
+ public Entry lookup( LookupOperationContext lookupContext ) throws LdapException
+ {
+ if ( IS_DEBUG )
+ {
+ LOG.debug( "Operation Context: {}", lookupContext );
+ }
+
+ // propagate the call to the next interceptor
+ return next( lookupContext );
+ }
+
+
+ /**
+ * {@inheritDoc}
+ */
+ @Override
+ public void modify( ModifyOperationContext modifyContext ) throws LdapException
+ {
+ if ( IS_DEBUG )
+ {
+ LOG.debug( "Operation Context: {}", modifyContext );
+ }
+
+ // propagate the call to the next interceptor
+ next( modifyContext );
+ }
+
+
+ /**
+ * {@inheritDoc}
+ */
+ @Override
+ public void move( MoveOperationContext moveContext ) throws LdapException
+ {
+ if ( IS_DEBUG )
+ {
+ LOG.debug( "Operation Context: {}", moveContext );
+ }
+
+ // propagate the call to the next interceptor
+ next( moveContext );
+ }
+
+
+ /**
+ * {@inheritDoc}
+ */
+ @Override
+ public void moveAndRename( MoveAndRenameOperationContext moveAndRenameContext ) throws LdapException
+ {
+ if ( IS_DEBUG )
+ {
+ LOG.debug( "Operation Context: {}", moveAndRenameContext );
+ }
+
+ // propagate the call to the next interceptor
+ next( moveAndRenameContext );
+ }
+
+
+ /**
+ * {@inheritDoc}
+ */
+ @Override
+ public void rename( RenameOperationContext renameContext ) throws LdapException
+ {
+ if ( IS_DEBUG )
+ {
+ LOG.debug( "Operation Context: {}", renameContext );
+ }
+
+ // propagate the call to the next interceptor
+ next( renameContext );
+ }
+
+
+ /**
+ * {@inheritDoc}
+ */
+ @Override
+ public EntryFilteringCursor search( SearchOperationContext searchContext ) throws LdapException
+ {
+ if ( IS_DEBUG )
+ {
+ LOG.debug( "Operation Context: {}", searchContext );
+ }
+
+ // propagate the call to the next interceptor
+ return next( searchContext );
+ }
+
+
+ /**
+ * {@inheritDoc}
+ */
+ @Override
+ public void unbind( UnbindOperationContext unbindContext ) throws LdapException
+ {
+ if ( IS_DEBUG )
+ {
+ LOG.debug( "Operation Context: {}", unbindContext );
+ }
+
+ // propagate the call to the next interceptor
+ next( unbindContext );
+ }
+
+
+ /**
+ * checks to see if the user's password should be changed before performing any operations
+ * other than bind, password update, unbind, abandon or StartTLS
+ *
+ * @param opContext the operation's context
+ * @throws LdapException
+ */
+ private void checkPwdReset( OperationContext opContext ) throws LdapException
+ {
+ if ( directoryService.isPwdPolicyEnabled() )
+ {
+ CoreSession session = opContext.getSession();
+
+ if ( session.isPwdMustChange() )
+ {
+ boolean isPPolicyReqCtrlPresent = opContext.hasRequestControl( PasswordPolicyRequest.OID );
+
+ if ( isPPolicyReqCtrlPresent )
+ {
+ PasswordPolicyResponse responseControl = new PasswordPolicyResponseImpl();
+ responseControl.setPasswordPolicyError( PasswordPolicyErrorEnum.CHANGE_AFTER_RESET );
+ opContext.addResponseControl( responseControl );
+ }
+
+ throw new LdapNoPermissionException( "password needs to be reset before performing this operation" );
+ }
+ }
+ }
+
+
+
+
+ /**
+ * Gets the effective password policy of the given entry.
+ * If the entry has defined a custom password policy by setting "pwdPolicySubentry" attribute
+ * then the password policy associated with the Dn specified at the above attribute's value will be returned.
+ * Otherwise the default password policy will be returned (if present)
+ *
+ * @param userEntry the user's entry
+ * @param operation The Operation. If it's a Add, then we have to find the PPolicy using the subentries
+ * @return the associated password policy
+ * @throws LdapException If we weren't able to fetch the password policy
+ */
+ private PasswordPolicyConfiguration getPwdPolicy( Entry userEntry, MessageTypeEnum operation ) throws LdapException
+ {
+ switch ( operation )
+ {
+ case ADD_REQUEST:
+ // Fetch the PPolicy from the subentries
+// if ( pwdPolicyContainer == null )
+// {
+// return null;
+// }
+
+// return pwdPolicyContainer.getDefaultPolicy();
+
+ case BIND_REQUEST:
+ case COMPARE_REQUEST:
+ case DEL_REQUEST:
+ case EXTENDED_REQUEST:
+ case MODIFY_REQUEST:
+ // The entry must have a pwdPolicySubentry AT
+ if ( userEntry.get( pwdPolicySubentryAT ) == null )
+ {
+ return null;
+ }
+
+ break;
+
+ case MODIFYDN_REQUEST:
+ case SEARCH_REQUEST:
+ case UNBIND_REQUEST:
+ case ABANDON_REQUEST:
+ default:
+ }
+
+/*
+ if ( pwdPolicyContainer == null )
+ {
+ return null;
+ }
+
+ if ( userEntry == null )
+ {
+ return pwdPolicyContainer.getDefaultPolicy();
+ }
+
+ if ( pwdPolicyContainer.hasCustomConfigs() )
+ {
+ Attribute pwdPolicySubentry = userEntry.get( pwdPolicySubentryAT );
+
+ if ( pwdPolicySubentry != null )
+ {
+ Dn configDn = dnFactory.create( pwdPolicySubentry.getString() );
+
+ PasswordPolicyConfiguration custom = pwdPolicyContainer.getPolicyConfig( configDn );
+
+ if ( custom != null )
+ {
+ return custom;
+ }
+ else
+ {
+ LOG.warn(
+ "The custom password policy for the user entry {} is not found, returning default policy configuration",
+ userEntry.getDn() );
+ }
+ }
+ }
+
+ return pwdPolicyContainer.getDefaultPolicy();
+*/
+ return null;
+ }
+
}
diff --git a/interceptors/ppolicy/src/main/java/org/apache/directory/server/core/ppolicy/PpolicyConfigContainer.java b/interceptors/ppolicy/src/main/java/org/apache/directory/server/core/ppolicy/PpolicyConfigContainer.java
new file mode 100644
index 0000000000..ff72f6d24a
--- /dev/null
+++ b/interceptors/ppolicy/src/main/java/org/apache/directory/server/core/ppolicy/PpolicyConfigContainer.java
@@ -0,0 +1,113 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ *
+ */
+
+package org.apache.directory.server.core.ppolicy;
+
+
+import java.util.HashMap;
+import java.util.Map;
+
+import org.apache.directory.api.ldap.model.name.Dn;
+import org.apache.directory.server.core.api.authn.ppolicy.PasswordPolicyConfiguration;
+
+
+/**
+ * A container to hold all the password policies defined in the server
+ *
+ * @author <a href="mailto:dev@directory.apache.org">Apache Directory Project</a>
+ */
+public class PpolicyConfigContainer
+{
+ /** a map holding the entry specific password policies */
+ private Map<Dn, PasswordPolicyConfiguration> ppolicyConfigMap = new HashMap<>();
+
+ /** the default password policy Dn */
+ private Dn defaultPolicyDn;
+
+
+ /**
+ * add a entry specific policy
+ *
+ * @param configDn the Dn where this entry's password policy is defined
+ * @param policyConfig the password policy configuration
+ */
+ public void addPolicy( Dn configDn, PasswordPolicyConfiguration policyConfig )
+ {
+ if ( configDn == null )
+ {
+ throw new IllegalArgumentException( "password policy config's Dn cannot be null" );
+ }
+
+ ppolicyConfigMap.put( configDn, policyConfig );
+ }
+
+
+ /**
+ * @return true if atleast one entry specific password policy exists, false otherwise
+ */
+ public boolean hasCustomConfigs()
+ {
+ return !ppolicyConfigMap.isEmpty();
+ }
+
+
+ /**
+ * Get the password policy configuration defined at a given Dn
+ *
+ * @param configDn the Dn where password policy was configured
+ * @return The found PasswordPolicyConfiguration instance
+ */
+ public PasswordPolicyConfiguration getPolicyConfig( Dn configDn )
+ {
+ return ppolicyConfigMap.get( configDn );
+ }
+
+
+ /**
+ * @return the default password policy, null if not configured
+ */
+ public PasswordPolicyConfiguration getDefaultPolicy()
+ {
+ return getPolicyConfig( defaultPolicyDn );
+ }
+
+
+ /**
+ * Set the default password policy configuration's Dn
+ *
+ * @param defaultPolicyDn the default password policy configuration's Dn
+ */
+ public void setDefaultPolicyDn( Dn defaultPolicyDn )
+ {
+ this.defaultPolicyDn = defaultPolicyDn;
+ }
+
+
+ /**
+ * deactivate an existing password policy.
+ *
+ * @param ppolicyConfigDn the Dn of the password policy configuration
+ * @return the deactivated password policy config object of the given reference Dn, null otherwise
+ */
+ public PasswordPolicyConfiguration removePolicyConfig( Dn ppolicyConfigDn )
+ {
+ return ppolicyConfigMap.remove( ppolicyConfigDn );
+ }
+}