[JIRA] Commented: (IDP-113) Create an authentication workflow action that validates a username/password against an LDAP directory

[Daniel W Fisher (JIRA)]

    [ https://issues.shibboleth.net/jira/browse/IDP-113?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13720#comment-13720 ] 

Daniel W Fisher commented on IDP-113:
-------------------------------------

A ppolicy implementation based on http://tools.ietf.org/html/draft-behera-ldap-password-policy-10 is completed. Tested against OpenLDAP and can be used with the default JNDI provider.

I want to get your opinion on what you expect in terms of an account policy API. What I have currently provides access to LDAP response controls (which would include ppolicy) and exception messages (which would include AD).
Should I go further and provide some message parsing functionality to convert the message String to some strongly typed Policy object or exception?
Should I go even further than that and attempt to consolidate all account policy data (controls, exceptions, etc) into some strong or loosely typed Policy object?
Maybe the best question is, what type of API do you want to see?


> Create an authentication workflow action that validates a username/password against an LDAP directory
> -----------------------------------------------------------------------------------------------------
>
>                 Key: IDP-113
>                 URL: https://issues.shibboleth.net/jira/browse/IDP-113
>             Project: Identity Provider
>          Issue Type: Task
>          Components: Authentication
>            Reporter: Chad La Joie
>            Assignee: Chad La Joie
>            Priority: Blocker
>             Fix For: 3.0.0
>
>   Original Estimate: 1 day
>  Remaining Estimate: 1 day
>
> Create an action that validates the username/password, given via the UsernamePasswordSubcontext on the authn request context, against an LDAP directory.  If the credentials properly validate then set a UsernamePrincipal as the authenticated principal of the authn request context.
> Additional notes:
>  * support enumerating multiple LDAP directories and failing over connections if some are down
>  * connections used to search for the user DN should have the option of being pooled
>  * ability to catch locked/disabled accounts and expired passwords

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira