Package org.opends.server.extensions

Class CryptPasswordStorageScheme

    • Constructor Detail

      • CryptPasswordStorageScheme

        public CryptPasswordStorageScheme()
        Creates a new instance of this password storage scheme. Note that no initialization should be performed here, as all initialization should be done in the initializePasswordStorageScheme method.

    • Method Detail

      • passwordMatches

        public boolean passwordMatches​(ByteSequence plaintextPassword,
                               ByteSequence storedPassword)
        Description copied from class: PasswordStorageScheme
        Indicates whether the provided plaintext password included in a bind request matches the given stored value. The provided stored value should not include the scheme name in curly braces.
        Specified by:
        passwordMatches in class PasswordStorageScheme<CryptPasswordStorageSchemeCfg>
        Parameters:
        plaintextPassword - The plaintext password provided by the user as part of a simple bind attempt.
        storedPassword - The stored password to compare against the provided plaintext password.
        Returns:
        true if the provided plaintext password matches the provided stored password, or false if not.

      • supportsAuthPasswordSyntax

        public boolean supportsAuthPasswordSyntax()
        Description copied from class: PasswordStorageScheme
        Indicates whether this password storage scheme supports the ability to interact with values using the authentication password syntax defined in RFC 3112.
        Specified by:
        supportsAuthPasswordSyntax in class PasswordStorageScheme<CryptPasswordStorageSchemeCfg>
        Returns:
        true if this password storage scheme supports the ability to interact with values using the authentication password syntax, or false if it does not.

      • encodeAuthPassword

        public ByteString encodeAuthPassword​(ByteSequence plaintext)
                              throws DirectoryException
        Description copied from class: PasswordStorageScheme
        Encodes the provided plaintext password for this storage scheme using the authentication password syntax defined in RFC 3112. Note that the provided plaintext password should not be altered in any way.
        Specified by:
        encodeAuthPassword in class PasswordStorageScheme<CryptPasswordStorageSchemeCfg>
        Parameters:
        plaintext - The plaintext version of the password.
        Returns:
        The password that has been encoded in the authentication password syntax.
        Throws:
        DirectoryException - If a problem occurs while processing of if this storage scheme does not support the authentication password syntax.

      • authPasswordMatches

        public boolean authPasswordMatches​(ByteSequence plaintextPassword,
                                   String authInfo,
                                   String authValue)
        Description copied from class: PasswordStorageScheme
        Indicates whether the provided plaintext password matches the encoded password using the authentication password syntax with the given authInfo and authValue components.
        Specified by:
        authPasswordMatches in class PasswordStorageScheme<CryptPasswordStorageSchemeCfg>
        Parameters:
        plaintextPassword - The plaintext password provided by the user.
        authInfo - The authInfo component of the password encoded in the authentication password syntax.
        authValue - The authValue component of the password encoded in the authentication password syntax.
        Returns:
        true if the provided plaintext password matches the encoded password according to the authentication password info syntax, or false if it does not or this storage scheme does not support the authentication password syntax.

      • isReversible

        public boolean isReversible()
        Description copied from class: PasswordStorageScheme
        Indicates whether this storage scheme is reversible (i.e., it is possible to obtain the original plaintext value from the stored password).
        Specified by:
        isReversible in class PasswordStorageScheme<CryptPasswordStorageSchemeCfg>
        Returns:
        true if this is a reversible password storage scheme, or false if it is not.

      • getAuthPasswordPlaintextValue

        public ByteString getAuthPasswordPlaintextValue​(String authInfo,
                                                String authValue)
                                         throws DirectoryException
        Description copied from class: PasswordStorageScheme
        Retrieves the original plaintext value for the provided password stored in the authPassword syntax. Note that this should only be called if isReversible returns true.
        Specified by:
        getAuthPasswordPlaintextValue in class PasswordStorageScheme<CryptPasswordStorageSchemeCfg>
        Parameters:
        authInfo - The authInfo component of the password encoded in the authentication password syntax.
        authValue - The authValue component of the password encoded in the authentication password syntax.
        Returns:
        The plaintext value for the provided stored password.
        Throws:
        DirectoryException - If it is not possible to obtain the plaintext value for the provided stored password, or if this storage scheme does not support the authPassword syntax..

      • isStorageSchemeSecure

        public boolean isStorageSchemeSecure()
        Description copied from class: PasswordStorageScheme
        Indicates whether this password storage scheme should be considered "secure". If the encoding used for this scheme does not obscure the value at all, or if it uses a method that is trivial to reverse (e.g., base64), then it should not be considered secure.

        This may be used to determine whether a password may be included in a set of search results, including the possibility of overriding access controls in the case that access controls would allow the password to be returned but the password is considered too insecure to reveal.
        Specified by:
        isStorageSchemeSecure in class PasswordStorageScheme<CryptPasswordStorageSchemeCfg>
        Returns:
        false if it may be trivial to discover the original plain-text password from the encoded form, or true if the scheme offers sufficient protection that revealing the encoded password will not easily reveal the corresponding plain-text value.

      • isConfigurationAcceptable

        public boolean isConfigurationAcceptable​(PasswordStorageSchemeCfg configuration,
                                         List<org.forgerock.i18n.LocalizableMessage> unacceptableReasons)
        Description copied from class: PasswordStorageScheme
        Indicates whether the provided configuration is acceptable for this password storage scheme. It should be possible to call this method on an uninitialized password storage scheme instance in order to determine whether the password storage scheme would be able to use the provided configuration.

        Note that implementations which use a subclass of the provided configuration class will likely need to cast the configuration to the appropriate subclass type.
        Overrides:
        isConfigurationAcceptable in class PasswordStorageScheme<CryptPasswordStorageSchemeCfg>
        Parameters:
        configuration - The password storage scheme configuration for which to make the determination.
        unacceptableReasons - A list that may be used to hold the reasons that the provided configuration is not acceptable.
        Returns:
        true if the provided configuration is acceptable for this password storage scheme, or false if not.

      • isConfigurationChangeAcceptable

        public boolean isConfigurationChangeAcceptable​(CryptPasswordStorageSchemeCfg configuration,
                                               List<org.forgerock.i18n.LocalizableMessage> unacceptableReasons)
        Description copied from interface: ConfigurationChangeListener
        Indicates whether the proposed change to the configuration is acceptable to this change listener.
        Specified by:
        isConfigurationChangeAcceptable in interface ConfigurationChangeListener<CryptPasswordStorageSchemeCfg>
        Parameters:
        configuration - The new configuration containing the changes.
        unacceptableReasons - A list that can be used to hold messages about why the provided configuration is not acceptable.
        Returns:
        Returns true if the proposed change is acceptable, or false if it is not.