ldaptive and openldap password policy

[Francesco Malvezzi]

Hi all,

I have just noticed that the great ldaptive ldap library allows handling
password expiration policies 1) with just a few lines in login.config:

ShibUserPassAuth {

    org.ldaptive.jaas.LdapLoginModule sufficient
    ldapUrl="ldap://ldap1.test.it:389"
    baseDn="ou=people,dc=test,dc=it"
    bindDn="cn=idp,ou=agents,dc=test,dc=it"
    bindCredential="secret"
    useStartTLS="true"
    authenticationControls="org.ldaptive.control.PasswordPolicyControl"

authenticationResponseHandlers="org.ldaptive.auth.ext.PasswordPolicyAuthenticationResponseHandler"
    userFilter="(uid={user})";
}

With ldaptive in jaas, login.jsp page receives a LoginException message
with the password policy informations ready for parsing.

No need for a custom authenticationHandler.

This solves for us a tricky problem with the openldap password policy
overlay.

Do you see something against this solution (apart from the need to add a
jar in lib)?

Thank you

Francesco

1) http://www.ldaptive.org/docs/guide/authentication/accountstate