Jasig/cas — pull request #396 by afolgado (2014-02-05 14:09:31+00:00)
Title: Cas 1418 password policy

Password about to expire messages are not very clear (and sometimes incorrect). I suggest this at DefaultAccountStateHandler (please see the inline comments):

protected void handleWarning(
final AccountState.Warning warning,
final AuthenticationResponse response,
final LdapPasswordPolicyConfiguration configuration,
final List messages) {

if (warning == null) {
return;
}

if (configuration.getPasswordWarningNumberOfDays() > -1 /* If passwordWarningNumberOfDays is configured to -1, warnings will not be shown */
&& warning.getLoginsRemaining() == 0 /* When loginsRemaining > 0, password is expired, so expiration messages would be confusing */) {
final Calendar expDate = warning.getExpiration();
final Days ttl = Days.daysBetween(Instant.now(), new Instant(expDate));
if (ttl != null ) {
if (ttl.getDays() == 0) {
messages.add(new Message(
"password.expiration.today",
"Your password expires today. Please change your password at {0}",
configuration.getPasswordPolicyUrl()));
} else if (ttl.getDays() < configuration.getPasswordWarningNumberOfDays()) {
/* passwordWarningNumberOfDays can be configured to 0 to show the warning only when the server throws it
* In ppolicy it can be configured with the pwdExpireWarning attribute */
messages.add(new PasswordExpiringWarningMessage(
"Password expires in {0} day(s). Please change your password at {1}",
ttl.getDays(),
configuration.getPasswordPolicyUrl()));
}
}
}
if (warning.getLoginsRemaining() > 0) {
messages.add(new Message(
"password.expiration.loginsRemaining",
"Your password has expired. You have {0} logins remaining before you MUST change your password." +
" Please change your password at {1}",
/* The correction getLoginsRemaining() -1 is needed to show "You have 0 logins remaining...".
* Otherwise the account would lock the time after "You have 1 logins remaining..." warning. */
warning.getLoginsRemaining() - 1,
configuration.getPasswordPolicyUrl()));

}
}