Update modify processing to fix a problem in which the server would refuse ...

neil_a_wilson

02.57.2007 581ef72380fdf73c6b4926d6ccc23d9ecfa6d3ad

Update modify processing to fix a problem in which the server would refuse to
allow an entry to be modified if it was associated with an invalid or
nonexistent password policy.  This even prevented administrators from
re-associating the entry with a valid password policy.  With this change, the
server will fall back to the default password policy for modify operations if
the user-specific policy cannot be retrieved.

OpenDS Issue Number:  2492

 opendj-sdk/opends/src/server/org/opends/server/core/PasswordPolicyState.java

@@ -49,6 +49,7 @@
import org.opends.server.api.PasswordGenerator;
import org.opends.server.api.PasswordStorageScheme;
import org.opends.server.api.PasswordValidator;
import org.opends.server.loggers.ErrorLogger;
import org.opends.server.loggers.debug.DebugTracer;
import org.opends.server.protocols.asn1.ASN1OctetString;
import org.opends.server.protocols.internal.InternalClientConnection;
@@ -77,7 +78,6 @@

import static org.opends.server.config.ConfigConstants.*;
import static org.opends.server.loggers.debug.DebugLogger.*;
import org.opends.server.loggers.ErrorLogger;
import static org.opends.messages.CoreMessages.*;
import static org.opends.server.schema.SchemaConstants.*;
import static org.opends.server.util.StaticUtils.*;
@@ -198,7 +198,7 @@
                             boolean debug)
       throws DirectoryException
  {
    this(userEntry, updateEntry, TimeThread.getTime(), debug);
    this(userEntry, updateEntry, TimeThread.getTime(), false, debug);
  }


@@ -211,11 +211,14 @@
   * should be used.
   *
   * @param  userEntry    The entry with the user account.
   * @param  updateEntry  Indicates whether changes should update the provided
   *                      user entry directly or whether they should be
   *                      collected as a set of modifications.
   * @param  updateEntry        Indicates whether changes should update the
   *                            provided user entry directly or whether they
   *                            should be collected as a set of modifications.
   * @param  currentTime  The time to use as the current time for all
   *                      time-related determinations.
   * @param  useDefaultOnError  Indicates whether the server should fall back to
   *                            using the default password policy if there is a
   *                            problem with the configured policy for the user.
   * @param  debug        Indicates whether to enable debugging for the
   *                      operations performed.
   *
@@ -224,7 +227,8 @@
   *                              perform any other state initialization.
   */
  public PasswordPolicyState(Entry userEntry, boolean updateEntry,
                             long currentTime, boolean debug)
                             long currentTime, boolean useDefaultOnError,
                             boolean debug)
       throws DirectoryException
  {
    this.userEntry   = userEntry;
@@ -233,7 +237,8 @@
    this.currentTime = currentTime;

    userDNString     = userEntry.getDN().toString();
    passwordPolicy   = getPasswordPolicyInternal(this.userEntry, this.debug);
    passwordPolicy   = getPasswordPolicyInternal(this.userEntry,
                                                 useDefaultOnError, this.debug);

    // Get the password changed time for the user.
    AttributeType type
@@ -279,6 +284,9 @@
   * returned.
   *
   * @param  userEntry    The user entry.
   * @param  useDefaultOnError  Indicates whether the server should fall back to
   *                            using the default password policy if there is a
   *                            problem with the configured policy for the user.
   * @param  debug        Indicates whether to enable debugging for the
   *                      operations performed.
   *
@@ -288,7 +296,7 @@
   *                              determine the password policy for the user.
   */
  private static PasswordPolicy getPasswordPolicyInternal(Entry userEntry,
                                                          boolean debug)
                                     boolean useDefaultOnError, boolean debug)
       throws DirectoryException
  {
    String userDNString = userEntry.getDN().toString();
@@ -325,9 +333,17 @@

          Message message = ERR_PWPSTATE_CANNOT_DECODE_SUBENTRY_VALUE_AS_DN.get(
              v.getStringValue(), userDNString, e.getMessage());
          if (useDefaultOnError)
          {
            ErrorLogger.logError(message);
            return DirectoryServer.getDefaultPasswordPolicy();
          }
          else
          {
          throw new DirectoryException(ResultCode.INVALID_DN_SYNTAX, message,
                                       e);
        }
        }

        PasswordPolicy policy = DirectoryServer.getPasswordPolicy(subentryDN);
        if (policy == null)
@@ -341,9 +357,17 @@

          Message message = ERR_PWPSTATE_NO_SUCH_POLICY.get(
              userDNString, String.valueOf(subentryDN));
          if (useDefaultOnError)
          {
            ErrorLogger.logError(message);
            return DirectoryServer.getDefaultPasswordPolicy();
          }
          else
          {
          throw new DirectoryException(
               DirectoryServer.getServerErrorResultCode(), message);
        }
        }

        if (debug)
        {

 opendj-sdk/opends/src/server/org/opends/server/workflowelement/localbackend/LocalBackendModifyOperation.java

@@ -96,6 +96,7 @@
import org.opends.server.types.operation.PostResponseModifyOperation;
import org.opends.server.types.operation.PreOperationModifyOperation;
import org.opends.server.types.operation.PostSynchronizationModifyOperation;
import org.opends.server.util.TimeThread;

import static org.opends.messages.CoreMessages.*;
import static org.opends.server.config.ConfigConstants.*;
@@ -416,7 +417,9 @@
          selfChange = entryDN.equals(getAuthorizationDN());

          // FIXME -- Need a way to enable debug mode.
          pwPolicyState = new PasswordPolicyState(currentEntry, false, false);
          pwPolicyState = new PasswordPolicyState(currentEntry, false,
                                                  TimeThread.getTime(), true,
                                                  false);
        }
        catch (DirectoryException de)
        {