com.unboundid.ldap.sdk.controls.PasswordExpiredControl не определяет просроченный пароль (Java)

Question

Я адаптировал предложенный пример кода в https://docs.ldap.com/ldap-sdk/docs/javadoc/com/unboundid/ldap/sdk/controls/PasswordExpiredControl.html под свои нужды.

public Boolean checkExpiration(String user, String pass) throws LDAPException {
        SSLSocketFactory socketFactory = null;
        try {
            socketFactory = createFactory();
        } catch (Exception e) {
            // CreateFactory Exception
            e.printStackTrace();
        }
        // Create a secure connection to the Active Directory server.
        final LDAPConnection connection = new LDAPConnection(socketFactory, myHost, (Integer.parseInt(portLdap)),
                bindDN, passDN);
        // Send a simple bind request to the directory server.
        BindRequest bindRequest = new SimpleBindRequest("uid=example1,ou=Corporate Users,dc=example,dc=com", pass);
        BindResult bindResult;
        boolean passwordExpired;
        try {
            bindResult = connection.bind(bindRequest);

            // If we got here, the bind was successful and we know the password was
            // not expired. However, we shouldn't ignore the result because the
            // password might be about to expire. To determine whether that is the
            // case, we should see if the bind result included a password expiring
            // control. I'm not interested on this.
            passwordExpired = false;
            return passwordExpired;
        } catch (LDAPException le) {
            // If we got here, then the bind failed. The failure may or may not have
            // been due to an expired password. To determine that, we should see if
            // the bind result included a password expired control.
            bindResult = new BindResult(le.toLDAPResult());
            ResultCode resultCode = le.getResultCode();
            String errorMessageFromServer = le.getDiagnosticMessage();
            PasswordExpiredControl expiredControl = PasswordExpiredControl.get(le);
            passwordExpired = expiredControl != null;
            return passwordExpired;
        } finally {
            connection.close();
        }

    }

Теперь я проверил, истек ли пароль пользователя на хосте openldap с помощью этой команды

    # ldapwhoami -H ldaps://localhost:636 -W -D "uid=example1,ou=Corporate Users,dc=example,dc=com" -e ppolicy -v

и ответ

    ldap_initialize( ldaps://localhost:636/??base )
    Enter LDAP Password:
    ldap_bind: Invalid credentials (49); Password expired

Итак, вопрос в том, что происходит? Почему пароль не определяется как просроченный?

PD: Я отладил значение expiringControl, и оно возвращает null а значение файла (LDAPException) равно LDAPException(resultCode=49 (invalid credentials), errorMessage='invalid credentials', ldapSDKVersion=5.1.0, revision=89705d759f7c1ab3bccb2870f8c2e7d529ed231b)

Answer 1

Наконец, я закончил публиковать вопрос на форуме UnboundID (https://sourceforge.net/p/ldap-sdk/discussion/1001257/thread/e95d52b047/), и они ответили очень быстро.

Итак, вот решение. Я добавил новые элементы, так как мой OpenLDAP не поддерживает PasswordExpiredControl, поэтому я добавилDraftBeheraLDAPPasswordPolicy10ResponseControl и изменив привязку на отnew SimpleBindRequest(dn, password) к new SimpleBindRequest(dn, password, new DraftBeheraLDAPPasswordPolicy10RequestControl()). Окончательный сценарий выглядит следующим образом.

public Boolean checkExpiration(String user, String pass) throws LDAPException {
        String cn = getCNFromUser(user);
        SSLSocketFactory socketFactory = null;
        try {
            socketFactory = createFactory();
        } catch (Exception e) {
            // CreateFactory Exception
            e.printStackTrace();
        }
        // Create a secure connection to the Active Directory server.
        final LDAPConnection connection = new LDAPConnection(socketFactory, myHost, (Integer.parseInt(portLdap)),
                bindDN, passDN);
        // Send a simple bind request to the directory server.
        BindRequest bindRequest = new SimpleBindRequest("cn=" + cn + ",ou=Corporate Users,dc=castor,dc=com", pass,
                new DraftBeheraLDAPPasswordPolicy10RequestControl());
        BindResult bindResult;
        boolean passwordExpired;
        try {
            bindResult = connection.bind(bindRequest);

            // If we got here, the bind was successful and we know the password was
            // not expired. However, we shouldn't ignore the result because the
            // password might be about to expire. To determine whether that is the
            // case, we should see if the bind result included a password expiring
            // control.
            passwordExpired = false;
            return passwordExpired;
        } catch (LDAPException le) {
            // If we got here, then the bind failed. The failure may or may not have
            // been due to an expired password. To determine that, we should see if
            // the bind result included a password expired control.
            bindResult = new BindResult(le.toLDAPResult());
            PasswordExpiredControl expiredControl = PasswordExpiredControl.get(le);
            // Checking if the expiredControl is not null, then it has an expired password
            passwordExpired = expiredControl != null;
            if (passwordExpired) {
                return passwordExpired;
            }
            // Obtaining control for password policy, this in case there's no support for
            // PasswordExpiredControl in LDAP server
            DraftBeheraLDAPPasswordPolicy10ResponseControl pwpResponse = DraftBeheraLDAPPasswordPolicy10ResponseControl
                    .get(bindResult);
            if (pwpResponse != null) {
                // Getting error type
                DraftBeheraLDAPPasswordPolicy10ErrorType errorType = pwpResponse.getErrorType();
                if (errorType != null) {
                    // There was a password policy error.
                    passwordExpired = errorType.name().matches("PASSWORD_EXPIRED");
                    if (!passwordExpired) {
                        System.out.print("There was other error: " + errorType.name());
                    }
                }
            }
            return passwordExpired;
        }

    }