// throw exception if userPassword quality checks fail
throw new LdapOperationException( ResultCodeEnum.CONSTRAINT_VIOLATION, e.getMessage(), e );
}
int histSize = policyConfig.getPwdInHistory();
Modification pwdRemHistMod = null;
Modification pwdAddHistMod = null;
String pwdChangedTime = DateUtils.getGeneralizedTime();
if ( histSize > 0 )
{
Attribute pwdHistoryAt = entry.get( AT_PWD_HISTORY );
if ( pwdHistoryAt == null )
{
pwdHistoryAt = new DefaultAttribute( AT_PWD_HISTORY );
}
List<PasswordHistory> pwdHistLst = new ArrayList<PasswordHistory>();
for ( Value<?> value : pwdHistoryAt )
{
PasswordHistory pwdh = new PasswordHistory( Strings.utf8ToString( value.getBytes() ) );
boolean matched = Arrays.equals( newPassword, pwdh.getPassword() );
if ( matched )
{
if ( isPPolicyReqCtrlPresent )
{
PasswordPolicyDecorator responseControl =
new PasswordPolicyDecorator( directoryService.getLdapCodecService(), true );
responseControl.getResponse().setPasswordPolicyError(
PasswordPolicyErrorEnum.PASSWORD_IN_HISTORY );
modifyContext.addResponseControl( responseControl );
}
throw new LdapOperationException( ResultCodeEnum.CONSTRAINT_VIOLATION,
"invalid reuse of password present in password history" );
}
pwdHistLst.add( pwdh );
}
if ( pwdHistLst.size() >= histSize )
{
// see the javadoc of PasswordHistory
Collections.sort( pwdHistLst );
// remove the oldest value
PasswordHistory remPwdHist = ( PasswordHistory ) pwdHistLst.toArray()[histSize - 1];
Attribute tempAt = new DefaultAttribute( AT_PWD_HISTORY );
tempAt.add( remPwdHist.getHistoryValue() );
pwdRemHistMod = new DefaultModification( REMOVE_ATTRIBUTE, tempAt );
}
PasswordHistory newPwdHist = new PasswordHistory( pwdChangedTime, newPassword );
pwdHistoryAt.add( newPwdHist.getHistoryValue() );
pwdAddHistMod = new DefaultModification( REPLACE_ATTRIBUTE, pwdHistoryAt );
}
next( modifyContext );
invalidateAuthenticatorCaches( modifyContext.getDn() );
LookupOperationContext lookupContext = new LookupOperationContext( adminSession, modifyContext.getDn(),
SchemaConstants.ALL_ATTRIBUTES_ARRAY );
entry = directoryService.getPartitionNexus().lookup( lookupContext );
if ( ( policyConfig.getPwdMinAge() > 0 ) || ( policyConfig.getPwdMaxAge() > 0 ) )
{
Attribute pwdChangedTimeAt = new DefaultAttribute( AT_PWD_CHANGED_TIME );
pwdChangedTimeAt.add( pwdChangedTime );
Modification pwdChangedTimeMod = new DefaultModification( REPLACE_ATTRIBUTE, pwdChangedTimeAt );
mods.add( pwdChangedTimeMod );
}
if ( pwdAddHistMod != null )
{
mods.add( pwdAddHistMod );
}
if ( pwdRemHistMod != null )
{
mods.add( pwdRemHistMod );
}
if ( policyConfig.isPwdMustChange() )
{
Attribute pwdMustChangeAt = new DefaultAttribute( AT_PWD_RESET );
Modification pwdMustChangeMod = null;
if ( modifyContext.getSession().isAnAdministrator() )
{
pwdMustChangeAt.add( "TRUE" );
pwdMustChangeMod = new DefaultModification( REPLACE_ATTRIBUTE, pwdMustChangeAt );
}
else
{
pwdMustChangeMod = new DefaultModification( REMOVE_ATTRIBUTE, pwdMustChangeAt );
removeFromPwdResetSet = true;
}
mods.add( pwdMustChangeMod );
}
}
// these two attributes will be removed irrespective of add or delete
Attribute pwdFailureTimeAt = entry.get( AT_PWD_FAILURE_TIME );
if ( pwdFailureTimeAt != null )
{
mods.add( new DefaultModification( REMOVE_ATTRIBUTE, pwdFailureTimeAt ) );
}
Attribute pwdGraceUseTimeAt = entry.get( AT_PWD_GRACE_USE_TIME );
if ( pwdGraceUseTimeAt != null )
{
mods.add( new DefaultModification( REMOVE_ATTRIBUTE, pwdGraceUseTimeAt ) );
}
if ( pwdModDetails.isDelete() )
{
Attribute pwdHistory = entry.get( AT_PWD_HISTORY );
if ( pwdHistory != null )
{
mods.add( new DefaultModification( REMOVE_ATTRIBUTE, pwdHistory ) );
}
Attribute pwdChangedTimeAt = entry.get( AT_PWD_CHANGED_TIME );
if ( pwdChangedTimeAt != null )
{
mods.add( new DefaultModification( REMOVE_ATTRIBUTE, pwdChangedTimeAt ) );
}
Attribute pwdMustChangeAt = entry.get( AT_PWD_RESET );
if ( pwdMustChangeAt != null )
{
mods.add( new DefaultModification( REMOVE_ATTRIBUTE, pwdMustChangeAt ) );
}
Attribute pwdAccountLockedTimeAt = entry.get( AT_PWD_ACCOUNT_LOCKED_TIME );
if ( pwdAccountLockedTimeAt != null )
{
mods.add( new DefaultModification( REMOVE_ATTRIBUTE, pwdAccountLockedTimeAt ) );
}
}
String csnVal = directoryService.getCSN().toString();
Modification csnMod = new DefaultModification( REPLACE_ATTRIBUTE, ENTRY_CSN_AT, csnVal );
mods.add( csnMod );
ModifyOperationContext internalModifyCtx = new ModifyOperationContext( adminSession );
internalModifyCtx.setPushToEvtInterceptor( true );
internalModifyCtx.setDn( modifyContext.getDn() );