[JIRA] Commented: (IDP-113) Create an authentication workflow action that validates a username/password against an LDAP directory

[Daniel W Fisher (JIRA)]

    [ https://issues.shibboleth.net/jira/browse/IDP-113?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13729#comment-13729 ] 

Daniel W Fisher commented on IDP-113:
-------------------------------------

Not all conditions are exceptional. For instance ppolicy supports warnings for timeBeforeExpiration and graceAuthNsRemaining. Other directories have similar notions of warnings related to authentications where the bind succeeds. The API I was hinting at should provide a way for clients to access those warnings. Have a look at:
http://code.google.com/p/vt-middleware/source/browse/vt-ldap/trunk/src/main/java/edu/vt/middleware/ldap/control/PasswordPolicyControl.java
and
http://code.google.com/p/vt-middleware/source/browse/#svn%2Fvt-ldap%2Ftrunk%2Fsrc%2Fmain%2Fjava%2Fedu%2Fvt%2Fmiddleware%2Fldap%2Fauth%2Fext

With this implementation I would be passing you the AccountState object, but I'm assuming you'll want to convert that to something generic.

I took a first step towards mapping typed exceptions in the #throwSecurityException() methods.


> Create an authentication workflow action that validates a username/password against an LDAP directory
> -----------------------------------------------------------------------------------------------------
>
>                 Key: IDP-113
>                 URL: https://issues.shibboleth.net/jira/browse/IDP-113
>             Project: Identity Provider
>          Issue Type: Task
>          Components: Authentication
>            Reporter: Chad La Joie
>            Assignee: Chad La Joie
>            Priority: Blocker
>             Fix For: 3.0.0
>
>   Original Estimate: 1 day
>  Remaining Estimate: 1 day
>
> Create an action that validates the username/password, given via the UsernamePasswordSubcontext on the authn request context, against an LDAP directory.  If the credentials properly validate then set a UsernamePrincipal as the authenticated principal of the authn request context.
> Additional notes:
>  * support enumerating multiple LDAP directories and failing over connections if some are down
>  * connections used to search for the user DN should have the option of being pooled
>  * ability to catch locked/disabled accounts and expired passwords

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira