}
Message message = ERR_PWPOLICY_INVALID_PASSWORD_ATTRIBUTE_SYNTAX.
get(String.valueOf(configEntryDN), passwordAttribute.getNameOrOID(),
String.valueOf(syntax));
throw new ConfigException(message);
}
// Get the default storage schemes. They must all reference valid storage
// schemes that support the syntax for the specified password attribute.
storageSchemeDNs =
configuration.getDefaultPasswordStorageSchemeDNs();
try
{
LinkedList<PasswordStorageScheme<?>> schemes =
new LinkedList<PasswordStorageScheme<?>>();
for (DN configEntryDN : storageSchemeDNs)
{
PasswordStorageScheme<?> scheme =
DirectoryServer.getPasswordStorageScheme(configEntryDN);
if (this.authPasswordSyntax &&
(! scheme.supportsAuthPasswordSyntax()))
{
Message message = ERR_PWPOLICY_SCHEME_DOESNT_SUPPORT_AUTH.get(
String.valueOf(configEntryDN),
this.passwordAttribute.getNameOrOID());
throw new ConfigException(message);
}
schemes.add(scheme);
}
this.defaultStorageSchemes =
new CopyOnWriteArrayList<PasswordStorageScheme<?>>(schemes);
}
catch (ConfigException ce)
{
throw ce;
}
catch (Exception e)
{
if (debugEnabled())
{
TRACER.debugCaught(DebugLogLevel.ERROR, e);
}
Message message = ERR_PWPOLICY_CANNOT_DETERMINE_DEFAULT_STORAGE_SCHEMES.
get(String.valueOf(configEntryDN), getExceptionMessage(e));
throw new InitializationException(message, e);
}
// Get the names of the deprecated storage schemes.
deprecatedStorageSchemeDNs =
configuration.getDeprecatedPasswordStorageSchemeDNs();
try
{
LinkedHashSet<String> newDeprecatedStorageSchemes =
new LinkedHashSet<String>();
for (DN schemeDN : deprecatedStorageSchemeDNs)
{
PasswordStorageScheme<?> scheme =
DirectoryServer.getPasswordStorageScheme(schemeDN);
if (this.authPasswordSyntax)
{
if (scheme.supportsAuthPasswordSyntax())
{
newDeprecatedStorageSchemes.add(
scheme.getAuthPasswordSchemeName());
}
else
{
Message message = ERR_PWPOLICY_DEPRECATED_SCHEME_NOT_AUTH.get(
String.valueOf(configEntryDN),
String.valueOf(schemeDN));
throw new ConfigException(message);
}
}
else
{
newDeprecatedStorageSchemes.add(
toLowerCase(scheme.getStorageSchemeName()));
}
}
this.deprecatedStorageSchemes =
new CopyOnWriteArraySet<String>(newDeprecatedStorageSchemes);
}
catch (Exception e)
{
if (debugEnabled())
{
TRACER.debugCaught(DebugLogLevel.ERROR, e);
}
Message message =
ERR_PWPOLICY_CANNOT_DETERMINE_DEPRECATED_STORAGE_SCHEMES.
get(String.valueOf(configEntryDN), getExceptionMessage(e));
throw new InitializationException(message, e);
}
// Get the password validators.
SortedSet<DN> passwordValidators = configuration.getPasswordValidatorDNs();
ConcurrentHashMap<DN, PasswordValidator<?>> validators =
new ConcurrentHashMap<DN, PasswordValidator<?>>();
for (DN validatorDN : passwordValidators)
{
validators.put(validatorDN,
DirectoryServer.getPasswordValidator(validatorDN));
}
this.passwordValidators = validators;
// Get the status notification handlers.
SortedSet<DN> statusNotificationHandlers =
configuration.getAccountStatusNotificationHandlerDNs();
ConcurrentHashMap<DN,AccountStatusNotificationHandler<?>> handlers =
new ConcurrentHashMap<DN,AccountStatusNotificationHandler<?>>();
for (DN handlerDN : statusNotificationHandlers)
{
AccountStatusNotificationHandler<?> handler =
DirectoryServer.getAccountStatusNotificationHandler(handlerDN);
handlers.put(handlerDN, handler);
}
this.notificationHandlers = handlers;
// Determine whether to allow user password changes.
this.allowUserPasswordChanges = configuration.isAllowUserPasswordChanges();
// Determine whether to require the current password for user changes.
this.requireCurrentPassword =
configuration.isPasswordChangeRequiresCurrentPassword();
// Determine whether to force password changes on add.
this.forceChangeOnAdd = configuration.isForceChangeOnAdd();
// Determine whether to force password changes on reset.
this.forceChangeOnReset = configuration.isForceChangeOnReset();
// Determine whether to validate reset passwords.
this.skipValidationForAdministrators =
configuration.isSkipValidationForAdministrators();
// Get the password generator.
DN passGenDN = configuration.getPasswordGeneratorDN() ;
if (passGenDN != null)
{
this.passwordGeneratorDN = passGenDN;
this.passwordGenerator = DirectoryServer.getPasswordGenerator(passGenDN);
}
// Determine whether to require secure authentication.
this.requireSecureAuthentication =
configuration.isRequireSecureAuthentication();
// Determine whether to require secure password changes.
this.requireSecurePasswordChanges =
configuration.isRequireSecurePasswordChanges() ;
// Determine whether to allow multiple password values.
this.allowMultiplePasswordValues =
configuration.isAllowMultiplePasswordValues();
// Determine whether to allow pre-encoded passwords.
this.allowPreEncodedPasswords = configuration.isAllowPreEncodedPasswords();
// Get the minimum password age.
this.minimumPasswordAge = (int) configuration.getMinPasswordAge();
// Get the maximum password age.
this.maximumPasswordAge = (int) configuration.getMaxPasswordAge();
// Get the maximum password reset age.
this.maximumPasswordResetAge = (int) configuration
.getMaxPasswordResetAge();
// Get the warning interval.
this.warningInterval = (int) configuration
.getPasswordExpirationWarningInterval();
// Determine whether to expire passwords without warning.
this.expirePasswordsWithoutWarning = configuration
.isExpirePasswordsWithoutWarning();
// If the expire without warning option is disabled, then there must be a
// warning interval.
if ((! this.expirePasswordsWithoutWarning()) &&
(this.getWarningInterval() <= 0))
{
Message message =
ERR_PWPOLICY_MUST_HAVE_WARNING_IF_NOT_EXPIRE_WITHOUT_WARNING.
get(String.valueOf(configEntryDN));
throw new ConfigException(message);
}
// Determine whether to allow user changes for expired passwords.
this.allowExpiredPasswordChanges = configuration
.isAllowExpiredPasswordChanges();
// Get the grace login count.
this.graceLoginCount = configuration.getGraceLoginCount();
// Get the lockout failure count.
this.lockoutFailureCount = configuration.getLockoutFailureCount();
// Get the lockout duration.
this.lockoutDuration = (int) configuration.getLockoutDuration();
// Get the lockout failure expiration interval.
this.lockoutFailureExpirationInterval = (int) configuration
.getLockoutFailureExpirationInterval();
// Get the required change time.
String requireChangeBy = configuration.getRequireChangeByTime();
try
{
if (requireChangeBy != null)
{
ByteString valueString = ByteString.valueOf(requireChangeBy);
GeneralizedTimeSyntax syntax =
(GeneralizedTimeSyntax)
DirectoryServer.getAttributeSyntax(SYNTAX_GENERALIZED_TIME_OID,
false);
if (syntax == null)
{
this.requireChangeByTime =
GeneralizedTimeSyntax.decodeGeneralizedTimeValue(valueString);
}
else
{
valueString =
syntax.getEqualityMatchingRule().normalizeValue(valueString);
this.requireChangeByTime =
GeneralizedTimeSyntax.decodeGeneralizedTimeValue(valueString);
}
}
}
catch (Exception e)
{
if (debugEnabled())
{
TRACER.debugCaught(DebugLogLevel.ERROR, e);
}
Message message = ERR_PWPOLICY_CANNOT_DETERMINE_REQUIRE_CHANGE_BY_TIME.
get(String.valueOf(configEntryDN), getExceptionMessage(e));
throw new InitializationException(message, e);
}
// Get the last login time attribute. If specified, it must be defined in
// the server schema. It does not need to have a generalized time syntax
// because the value that it will store will not necessarily conform to this
// format.
lastLoginTimeAttribute = configuration.getLastLoginTimeAttribute();
// Get the last login time format. If specified, it must be a valid format
// string.
String formatString = configuration.getLastLoginTimeFormat();
try
{
if (formatString != null)
{
try
{
new SimpleDateFormat(formatString);
}
catch (Exception e)
{
if (debugEnabled())
{
TRACER.debugCaught(DebugLogLevel.ERROR, e);
}
Message message = ERR_PWPOLICY_INVALID_LAST_LOGIN_TIME_FORMAT.get(
String.valueOf(configEntryDN), String.valueOf(formatString));
throw new ConfigException(message);
}
this.lastLoginTimeFormat = formatString;
}
}
catch (ConfigException ce)
{
throw ce;
}
catch (Exception e)
{
if (debugEnabled())
{
TRACER.debugCaught(DebugLogLevel.ERROR, e);
}
Message message = ERR_PWPOLICY_CANNOT_DETERMINE_LAST_LOGIN_TIME_FORMAT.
get(String.valueOf(configEntryDN), getExceptionMessage(e));
throw new InitializationException(message, e);
}
// Get the previous last login time formats. If specified, they must all
// be valid format strings.
SortedSet<String> formatStrings =
configuration.getPreviousLastLoginTimeFormat() ;
try
{
if (formatStrings != null)
{
for (String s : formatStrings)
{
try
{
new SimpleDateFormat(s);
}
catch (Exception e)
{
if (debugEnabled())
{
TRACER.debugCaught(DebugLogLevel.ERROR, e);
}
Message message =
ERR_PWPOLICY_INVALID_PREVIOUS_LAST_LOGIN_TIME_FORMAT.
get(String.valueOf(configEntryDN), String.valueOf(s));
throw new ConfigException(message);
}
}
this.previousLastLoginTimeFormats =
new CopyOnWriteArrayList<String>(formatStrings);
}
}
catch (ConfigException ce)
{
throw ce;
}
catch (Exception e)
{
if (debugEnabled())
{
TRACER.debugCaught(DebugLogLevel.ERROR, e);
}
Message message =
ERR_PWPOLICY_CANNOT_DETERMINE_PREVIOUS_LAST_LOGIN_TIME_FORMAT.
get(String.valueOf(configEntryDN), getExceptionMessage(e));
throw new InitializationException(message, e);
}
// Get the idle lockout duration.
this.idleLockoutInterval = (int) configuration.getIdleLockoutInterval();
// Get the state update failure policy.
this.stateUpdateFailurePolicy = configuration.getStateUpdateFailurePolicy();
// Get the password history count and duration.
this.historyCount = configuration.getPasswordHistoryCount();
this.historyDuration = (int) configuration.getPasswordHistoryDuration();
/*
* Holistic validation.
*/
// Ensure that the password attribute was included in the configuration
// entry, since it is required.
if (passwordAttribute == null)
{
Message message =
ERR_PWPOLICY_NO_PASSWORD_ATTRIBUTE.get(String.valueOf(configEntryDN));
throw new ConfigException(message);
}
// Ensure that at least one default password storage scheme was included in
// the configuration entry, since it is required.
if (defaultStorageSchemes.isEmpty())
{
Message message = ERR_PWPOLICY_NO_DEFAULT_STORAGE_SCHEMES.get(
String.valueOf(configEntryDN));
throw new ConfigException(message);
}
// If both a maximum password age and a warning interval are provided, then
// ensure that the warning interval is less than the maximum age. Further,
// if a minimum age is specified, then the sum of the minimum age and the
// warning interval should be less than the maximum age.
if (maximumPasswordAge > 0)
{
int warnInterval = Math.max(0, warningInterval);
if (minimumPasswordAge > 0)
{
if ((warnInterval + minimumPasswordAge) >= maximumPasswordAge)
{
Message message =
ERR_PWPOLICY_MIN_AGE_PLUS_WARNING_GREATER_THAN_MAX_AGE.
get(String.valueOf(configEntryDN));
throw new ConfigException(message);
}
}
else if (warnInterval >= maximumPasswordAge)
{
Message message = ERR_PWPOLICY_WARNING_INTERVAL_LARGER_THAN_MAX_AGE.get(
String.valueOf(configEntryDN));
throw new ConfigException(message);
}
}
}