Jasig/cas — pull request #266 by swenhelge (2013-06-04 14:59:21+00:00)
Title: Lppe ppolicy openldap

Hi,

I would like to submit this change to the ldap password enforcement component so that it supports OpenLDAP ppolicy.

ppolicy uses LDAP v3 controls to signal password expiration etc to the client.

This means that the bind attempt to enforce the password policy must be made using the original user's credentials (in contrast to Active Directory mechanism where one binds as administrator, then looks up and evaluates the user's entry).

Thus the PasswordPolicyEnforcer interface required amendment.

The solution we came up with here uses the existing PasswordPolicyEnforcer infrastructure.
A better solution would be to incorporate the policy check into the initial bind attempt using the user's credential.
(the implication here is that there always 2 user bind attempts to authenticate a user meaning the max grace log-in count needs to a multiple of 2.)

Would appreciate if this made it into the official CAS repository so we can stop maintaing a forked version of CAS.

Thanks,

Swen