this.passwordPolicySubentryDN = subentry.getDN();
// Get known Password Policy draft attributes from the entry.
// If any given attribute is missing or empty set its value
// from default Password Policy configuration.
AttributeValue value = getAttrValue(entry, PWD_ATTR_ATTRIBUTE);
if ((value != null) && (value.toString().length() > 0)) {
this.pPasswordAttribute = DirectoryServer.getAttributeType(
value.toString().toLowerCase(), false);
if (this.pPasswordAttribute == null) {
throw new DirectoryException(ResultCode.UNWILLING_TO_PERFORM,
ERR_PWPOLICY_UNDEFINED_PASSWORD_ATTRIBUTE.get(
this.passwordPolicySubentryDN.toNormalizedString(),
value.toString()));
}
} else {
// This should not normally happen since pwdAttribute
// declared as MUST but handle this anyway in case
// the schema is not enforced for some reason.
this.pPasswordAttribute =
defaultPasswordPolicy.getPasswordAttribute();
}
value = getAttrValue(entry, PWD_ATTR_MINAGE);
if ((value != null) && (value.toString().length() > 0)) {
try {
this.pMinPasswordAge = Long.parseLong(value.toString());
checkIntegerAttr(PWD_ATTR_MINAGE, this.pMinPasswordAge,
0, Integer.MAX_VALUE);
} catch (NumberFormatException ne) {
throw new DirectoryException(ResultCode.CONSTRAINT_VIOLATION,
ERR_CONFIG_ATTR_INVALID_INT_VALUE.get(
PWD_ATTR_MINAGE, value.toString(),
ne.getLocalizedMessage()));
}
} else {
this.pMinPasswordAge =
defaultPasswordPolicy.getMinimumPasswordAge();
}
value = getAttrValue(entry, PWD_ATTR_MAXAGE);
if ((value != null) && (value.toString().length() > 0)) {
try {
this.pMaxPasswordAge = Long.parseLong(value.toString());
checkIntegerAttr(PWD_ATTR_MAXAGE, this.pMaxPasswordAge,
0, Integer.MAX_VALUE);
} catch (NumberFormatException ne) {
throw new DirectoryException(ResultCode.CONSTRAINT_VIOLATION,
ERR_CONFIG_ATTR_INVALID_INT_VALUE.get(
PWD_ATTR_MINAGE, value.toString(),
ne.getLocalizedMessage()));
}
} else {
this.pMaxPasswordAge =
defaultPasswordPolicy.getMaximumPasswordAge();
}
value = getAttrValue(entry, PWD_ATTR_INHISTORY);
if ((value != null) && (value.toString().length() > 0)) {
try {
this.pPasswordHistoryCount = Integer.parseInt(value.toString());
checkIntegerAttr(PWD_ATTR_INHISTORY,
this.pPasswordHistoryCount, 0, Integer.MAX_VALUE);
} catch (NumberFormatException ne) {
throw new DirectoryException(ResultCode.CONSTRAINT_VIOLATION,
ERR_CONFIG_ATTR_INVALID_INT_VALUE.get(
PWD_ATTR_MINAGE, value.toString(),
ne.getLocalizedMessage()));
}
} else {
this.pPasswordHistoryCount =
defaultPasswordPolicy.getPasswordHistoryCount();
}
// This one is managed via the password validator
// so only check if its value is acceptable.
value = getAttrValue(entry, PWD_ATTR_CHECKQUALITY);
if ((value != null) && (value.toString().length() > 0)) {
try {
int pwdCheckQuality = Integer.parseInt(value.toString());
checkIntegerAttr(PWD_ATTR_CHECKQUALITY, pwdCheckQuality,
0, 2);
} catch (NumberFormatException ne) {
throw new DirectoryException(ResultCode.CONSTRAINT_VIOLATION,
ERR_CONFIG_ATTR_INVALID_INT_VALUE.get(
PWD_ATTR_MINAGE, value.toString(),
ne.getLocalizedMessage()));
}
}
// This one is managed via the password validator
// so only check if its value is acceptable.
value = getAttrValue(entry, PWD_ATTR_MINLENGTH);
if ((value != null) && (value.toString().length() > 0)) {
try {
int pwdMinLength = Integer.parseInt(value.toString());
checkIntegerAttr(PWD_ATTR_MINLENGTH, pwdMinLength,
0, Integer.MAX_VALUE);
} catch (NumberFormatException ne) {
throw new DirectoryException(ResultCode.CONSTRAINT_VIOLATION,
ERR_CONFIG_ATTR_INVALID_INT_VALUE.get(
PWD_ATTR_MINAGE, value.toString(),
ne.getLocalizedMessage()));
}
}
// This one depends on lockout failure count value
// so only check if its value is acceptable.
value = getAttrValue(entry, PWD_ATTR_LOCKOUT);
if ((value != null) && (value.toString().length() > 0)) {
if (value.toString().equalsIgnoreCase(Boolean.TRUE.toString()) ||
value.toString().equalsIgnoreCase(Boolean.FALSE.toString())) {
Boolean.parseBoolean(value.toString());
} else {
throw new DirectoryException(ResultCode.CONSTRAINT_VIOLATION,
ERR_CONFIG_ATTR_INVALID_BOOLEAN_VALUE.get(
PWD_ATTR_MUSTCHANGE, value.toString()));
}
}
value = getAttrValue(entry, PWD_ATTR_EXPIREWARNING);
if ((value != null) && (value.toString().length() > 0)) {
try {
this.pPasswordExpirationWarningInterval =
Long.parseLong(value.toString());
checkIntegerAttr(PWD_ATTR_EXPIREWARNING,
this.pPasswordExpirationWarningInterval,
0, Integer.MAX_VALUE);
} catch (NumberFormatException ne) {
throw new DirectoryException(ResultCode.CONSTRAINT_VIOLATION,
ERR_CONFIG_ATTR_INVALID_INT_VALUE.get(
PWD_ATTR_MINAGE, value.toString(),
ne.getLocalizedMessage()));
}
} else {
this.pPasswordExpirationWarningInterval =
defaultPasswordPolicy.getWarningInterval();
}
value = getAttrValue(entry, PWD_ATTR_GRACEAUTHNLIMIT);
if ((value != null) && (value.toString().length() > 0)) {
try {
this.pGraceLoginCount = Integer.parseInt(value.toString());
checkIntegerAttr(PWD_ATTR_GRACEAUTHNLIMIT,
this.pGraceLoginCount, 0, Integer.MAX_VALUE);
} catch (NumberFormatException ne) {
throw new DirectoryException(ResultCode.CONSTRAINT_VIOLATION,
ERR_CONFIG_ATTR_INVALID_INT_VALUE.get(
PWD_ATTR_MINAGE, value.toString(),
ne.getLocalizedMessage()));
}
} else {
this.pGraceLoginCount =
defaultPasswordPolicy.getGraceLoginCount();
}
value = getAttrValue(entry, PWD_ATTR_LOCKOUTDURATION);
if ((value != null) && (value.toString().length() > 0)) {
try {
this.pLockoutDuration = Long.parseLong(value.toString());
checkIntegerAttr(PWD_ATTR_LOCKOUTDURATION,
this.pLockoutDuration, 0, Integer.MAX_VALUE);
} catch (NumberFormatException ne) {
throw new DirectoryException(ResultCode.CONSTRAINT_VIOLATION,
ERR_CONFIG_ATTR_INVALID_INT_VALUE.get(
PWD_ATTR_MINAGE, value.toString(),
ne.getLocalizedMessage()));
}
} else {
this.pLockoutDuration =
defaultPasswordPolicy.getLockoutDuration();
}
value = getAttrValue(entry, PWD_ATTR_MAXFAILURE);
if ((value != null) && (value.toString().length() > 0)) {
try {
this.pLockoutFailureCount = Integer.parseInt(value.toString());
checkIntegerAttr(PWD_ATTR_MAXFAILURE,
this.pLockoutFailureCount, 0, Integer.MAX_VALUE);
} catch (NumberFormatException ne) {
throw new DirectoryException(ResultCode.CONSTRAINT_VIOLATION,
ERR_CONFIG_ATTR_INVALID_INT_VALUE.get(
PWD_ATTR_MINAGE, value.toString(),
ne.getLocalizedMessage()));
}
} else {
this.pLockoutFailureCount =
defaultPasswordPolicy.getLockoutFailureCount();
}
value = getAttrValue(entry, PWD_ATTR_MUSTCHANGE);
if ((value != null) && (value.toString().length() > 0)) {
if (value.toString().equalsIgnoreCase(Boolean.TRUE.toString()) ||
value.toString().equalsIgnoreCase(Boolean.FALSE.toString())) {
this.pForceChangeOnReset =
Boolean.parseBoolean(value.toString());
} else {
throw new DirectoryException(ResultCode.CONSTRAINT_VIOLATION,
ERR_CONFIG_ATTR_INVALID_BOOLEAN_VALUE.get(
PWD_ATTR_MUSTCHANGE, value.toString()));
}
} else {
this.pForceChangeOnReset =
defaultPasswordPolicy.forceChangeOnReset();
}
value = getAttrValue(entry, PWD_ATTR_ALLOWUSERCHANGE);
if ((value != null) && (value.toString().length() > 0)) {
if (value.toString().equalsIgnoreCase(Boolean.TRUE.toString()) ||
value.toString().equalsIgnoreCase(Boolean.FALSE.toString())) {
this.pAllowUserPasswordChanges =
Boolean.parseBoolean(value.toString());
} else {
throw new DirectoryException(ResultCode.CONSTRAINT_VIOLATION,
ERR_CONFIG_ATTR_INVALID_BOOLEAN_VALUE.get(
PWD_ATTR_ALLOWUSERCHANGE, value.toString()));
}
} else {
this.pAllowUserPasswordChanges =
defaultPasswordPolicy.allowUserPasswordChanges();
}
value = getAttrValue(entry, PWD_ATTR_SAFEMODIFY);
if ((value != null) && (value.toString().length() > 0)) {
if (value.toString().equalsIgnoreCase(Boolean.TRUE.toString()) ||
value.toString().equalsIgnoreCase(Boolean.FALSE.toString())) {
this.pPasswordChangeRequiresCurrentPassword =
Boolean.parseBoolean(value.toString());
} else {
throw new DirectoryException(ResultCode.CONSTRAINT_VIOLATION,
ERR_CONFIG_ATTR_INVALID_BOOLEAN_VALUE.get(
PWD_ATTR_SAFEMODIFY, value.toString()));
}
} else {
this.pPasswordChangeRequiresCurrentPassword =
defaultPasswordPolicy.requireCurrentPassword();
}
value = getAttrValue(entry, PWD_ATTR_FAILURECOUNTINTERVAL);
if ((value != null) && (value.toString().length() > 0)) {
try {
this.pLockoutFailureExpirationInterval =
Long.parseLong(value.toString());
checkIntegerAttr(PWD_ATTR_FAILURECOUNTINTERVAL,
this.pLockoutFailureExpirationInterval,
0, Integer.MAX_VALUE);
} catch (NumberFormatException ne) {
throw new DirectoryException(ResultCode.CONSTRAINT_VIOLATION,
ERR_CONFIG_ATTR_INVALID_INT_VALUE.get(
PWD_ATTR_FAILURECOUNTINTERVAL, value.toString(),
ne.getLocalizedMessage()));
}
} else {
this.pLockoutFailureExpirationInterval =
defaultPasswordPolicy.getLockoutFailureExpirationInterval();