public void handleExtendedOperation( LdapSession requestor, PwdModifyRequest req ) throws Exception
{
LOG.debug( "Password modification requested" );
// Grab the adminSession, we might need it later
DirectoryService service = requestor.getLdapServer().getDirectoryService();
CoreSession adminSession = service.getAdminSession();
String userIdentity = Strings.utf8ToString( req.getUserIdentity() );
Dn userDn = null;
if ( !Strings.isEmpty( userIdentity ) )
{
try
{
userDn = service.getDnFactory().create( userIdentity );
}
catch ( LdapInvalidDnException lide )
{
LOG.error( "The user DN is invalid : " + userDn );
// The userIdentity is not a DN : return with an error code.
requestor.getIoSession().write( new PwdModifyResponseImpl(
req.getMessageId(), ResultCodeEnum.INVALID_DN_SYNTAX, "The user DN is invalid : " + userDn ) );
return;
}
}
byte[] oldPassword = req.getOldPassword();
byte[] newPassword = req.getNewPassword();
// First check if the user is bound or not
if ( requestor.isAuthenticated() )
{
Dn principalDn = requestor.getCoreSession().getEffectivePrincipal().getDn();
LOG.debug( "Trying to modify password for user " + principalDn );
// First, check that the userDn is null : we can't change the password of someone else
// except if we are admin
if ( ( userDn != null ) && ( !userDn.equals( principalDn ) ) )
{
// Are we admin ?
if ( !requestor.getCoreSession().isAdministrator() )
{
// No : error
LOG.error( "Cannot access to another user's password to modify it" );
requestor.getIoSession().write( new PwdModifyResponseImpl(
req.getMessageId(), ResultCodeEnum.INSUFFICIENT_ACCESS_RIGHTS,
"Cannot access to another user's password to modify it" ) );
}
else
{
// We are administrator, we can try to modify the user's credentials
modifyUserPassword( requestor, userDn, oldPassword, newPassword, req );
}
}
else
{
// We are trying to modify our own password
modifyOwnPassword( requestor, principalDn, oldPassword, newPassword, req );
}
}
else
{
// The user is not authenticated : we have to use the provided userIdentity
// and the oldPassword to check if the user is present
BindOperationContext bindContext = new BindOperationContext( adminSession );
bindContext.setDn( userDn );
bindContext.setCredentials( oldPassword );
try
{
service.getOperationManager().bind( bindContext );
}
catch ( LdapException le )
{
// We can't bind with the provided information : we thus can't
// change the password...
requestor.getIoSession().write( new PwdModifyResponseImpl(
req.getMessageId(), ResultCodeEnum.INVALID_CREDENTIALS ) );
return;
}
// Ok, we were able to bind using the userIdentity and the password. Let's
// modify the password now
ModifyOperationContext modifyContext = new ModifyOperationContext( adminSession );
modifyContext.setDn( userDn );
List<Modification> modifications = new ArrayList<Modification>();
Modification modification = new DefaultModification( ModificationOperation.REPLACE_ATTRIBUTE,
SchemaConstants.USER_PASSWORD_AT, newPassword );
modifications.add( modification );
modifyContext.setModItems( modifications );
try
{
service.getOperationManager().modify( modifyContext );
// Ok, all done
requestor.getIoSession().write( new PwdModifyResponseImpl(
req.getMessageId(), ResultCodeEnum.SUCCESS ) );
}