org.opends.server.api

Class PasswordStorageScheme<T extends org.forgerock.opendj.server.config.server.PasswordStorageSchemeCfg>

java.lang.Object

org.opends.server.api.PasswordStorageScheme<T>

Type Parameters:

T - The type of configuration handled by this password storage scheme

Direct Known Subclasses:

AESPasswordStorageScheme, Base64PasswordStorageScheme, BcryptPasswordStorageScheme, BlowfishPasswordStorageScheme, ClearPasswordStorageScheme, CryptPasswordStorageScheme, MD5PasswordStorageScheme, PBKDF2PasswordStorageScheme, PKCS5S2PasswordStorageScheme, RC4PasswordStorageScheme, SaltedMD5PasswordStorageScheme, SaltedSHA1PasswordStorageScheme, SaltedSHA256PasswordStorageScheme, SaltedSHA384PasswordStorageScheme, SaltedSHA512PasswordStorageScheme, SHA1PasswordStorageScheme, TripleDESPasswordStorageScheme

@PublicAPI(stability=UNCOMMITTED,
           mayInstantiate=false,
           mayExtend=true,
           mayInvoke=false)
public abstract class PasswordStorageScheme<T extends org.forgerock.opendj.server.config.server.PasswordStorageSchemeCfg>
extends Object

This class defines the set of methods and structures that must be implemented by a Directory Server module that implements a password storage scheme. Each subclass may only implement a single password storage scheme type.

Constructor Summary

Constructors

Constructor and Description
PasswordStorageScheme()

Method Summary

Modifier and Type	Method and Description
abstract boolean	authPasswordMatches(org.forgerock.opendj.ldap.ByteSequence plaintextPassword, String authInfo, String authValue) Indicates whether the provided plaintext password matches the encoded password using the authentication password syntax with the given authInfo and authValue components.
abstract org.forgerock.opendj.ldap.ByteString	encodeAuthPassword(org.forgerock.opendj.ldap.ByteSequence plaintext) Encodes the provided plaintext password for this storage scheme using the authentication password syntax defined in RFC 3112.
abstract org.forgerock.opendj.ldap.ByteString	encodePassword(org.forgerock.opendj.ldap.ByteSequence plaintext) Encodes the provided plaintext password for this storage scheme, without the name of the associated scheme.
abstract org.forgerock.opendj.ldap.ByteString	encodePasswordWithScheme(org.forgerock.opendj.ldap.ByteSequence plaintext) Encodes the provided plaintext password for this storage scheme, prepending the name of the scheme in curly braces.
void	finalizePasswordStorageScheme() Performs any necessary finalization that might be required when this password storage scheme is no longer needed (e.g., the scheme is disabled or the server is shutting down).
abstract org.forgerock.opendj.ldap.ByteString	getAuthPasswordPlaintextValue(String authInfo, String authValue) Retrieves the original plaintext value for the provided password stored in the authPassword syntax.
String	getAuthPasswordSchemeName() Retrieves the scheme name that should be used with this password storage scheme when it is used in the context of the authentication password syntax.
abstract org.forgerock.opendj.ldap.ByteString	getPlaintextValue(org.forgerock.opendj.ldap.ByteSequence storedPassword) Retrieves the original plaintext value for the provided stored password.
abstract String	getStorageSchemeName() Retrieves the name of the password storage scheme provided by this handler.
abstract void	initializePasswordStorageScheme(T configuration) Initializes this password storage scheme handler based on the information in the provided configuration entry.
boolean	isConfigurationAcceptable(org.forgerock.opendj.server.config.server.PasswordStorageSchemeCfg configuration, List<org.forgerock.i18n.LocalizableMessage> unacceptableReasons) Indicates whether the provided configuration is acceptable for this password storage scheme.
abstract boolean	isReversible() Indicates whether this storage scheme is reversible (i.e., it is possible to obtain the original plaintext value from the stored password).
abstract boolean	isStorageSchemeSecure() Indicates whether this password storage scheme should be considered "secure".
abstract boolean	passwordMatches(org.forgerock.opendj.ldap.ByteSequence plaintextPassword, org.forgerock.opendj.ldap.ByteSequence storedPassword) Indicates whether the provided plaintext password included in a bind request matches the given stored value.
abstract boolean	supportsAuthPasswordSyntax() Indicates whether this password storage scheme supports the ability to interact with values using the authentication password syntax defined in RFC 3112.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

PasswordStorageScheme

public PasswordStorageScheme()

Method Detail

initializePasswordStorageScheme

public abstract void initializePasswordStorageScheme(T configuration)
                                              throws org.forgerock.opendj.config.server.ConfigException,
                                                     InitializationException

Initializes this password storage scheme handler based on the information in the provided configuration entry. It should also register itself with the Directory Server for the particular storage scheme that it will manage.

Parameters:

configuration - The configuration entry that contains the information to use to initialize this password storage scheme handler.

Throws:

org.forgerock.opendj.config.server.ConfigException - If an unrecoverable problem arises in the process of performing the initialization.

InitializationException - If a problem occurs during initialization that is not related to the server configuration.

isConfigurationAcceptable

public boolean isConfigurationAcceptable(org.forgerock.opendj.server.config.server.PasswordStorageSchemeCfg configuration,
                                         List<org.forgerock.i18n.LocalizableMessage> unacceptableReasons)

Indicates whether the provided configuration is acceptable for this password storage scheme. It should be possible to call this method on an uninitialized password storage scheme instance in order to determine whether the password storage scheme would be able to use the provided configuration.

Note that implementations which use a subclass of the provided configuration class will likely need to cast the configuration to the appropriate subclass type.

Parameters:

configuration - The password storage scheme configuration for which to make the determination.

unacceptableReasons - A list that may be used to hold the reasons that the provided configuration is not acceptable.

Returns:

true if the provided configuration is acceptable for this password storage scheme, or false if not.

finalizePasswordStorageScheme

public void finalizePasswordStorageScheme()

Performs any necessary finalization that might be required when this password storage scheme is no longer needed (e.g., the scheme is disabled or the server is shutting down).

getStorageSchemeName

public abstract String getStorageSchemeName()

Retrieves the name of the password storage scheme provided by this handler.

Returns:

The name of the password storage scheme provided by this handler.

encodePassword

public abstract org.forgerock.opendj.ldap.ByteString encodePassword(org.forgerock.opendj.ldap.ByteSequence plaintext)
                                                             throws DirectoryException

Encodes the provided plaintext password for this storage scheme, without the name of the associated scheme. Note that the provided plaintext password should not be altered in any way.

Parameters:

plaintext - The plaintext version of the password.

Returns:

The password that has been encoded using this storage scheme.

Throws:

DirectoryException - If a problem occurs while processing.

encodePasswordWithScheme

public abstract org.forgerock.opendj.ldap.ByteString encodePasswordWithScheme(org.forgerock.opendj.ldap.ByteSequence plaintext)
                                                                       throws DirectoryException

Encodes the provided plaintext password for this storage scheme, prepending the name of the scheme in curly braces. Note that the provided plaintext password should not be altered in any way.

Parameters:

plaintext - The plaintext version of the password.

Returns:

The encoded password, including the name of the storage scheme.

Throws:

DirectoryException - If a problem occurs while processing.

passwordMatches

public abstract boolean passwordMatches(org.forgerock.opendj.ldap.ByteSequence plaintextPassword,
                                        org.forgerock.opendj.ldap.ByteSequence storedPassword)

Indicates whether the provided plaintext password included in a bind request matches the given stored value. The provided stored value should not include the scheme name in curly braces.

Parameters:

plaintextPassword - The plaintext password provided by the user as part of a simple bind attempt.

storedPassword - The stored password to compare against the provided plaintext password.

Returns:

true if the provided plaintext password matches the provided stored password, or false if not.

supportsAuthPasswordSyntax

public abstract boolean supportsAuthPasswordSyntax()

Indicates whether this password storage scheme supports the ability to interact with values using the authentication password syntax defined in RFC 3112.

Returns:

true if this password storage scheme supports the ability to interact with values using the authentication password syntax, or false if it does not.

getAuthPasswordSchemeName

public String getAuthPasswordSchemeName()

Retrieves the scheme name that should be used with this password storage scheme when it is used in the context of the authentication password syntax. This default implementation will return the same value as the getStorageSchemeName method.

Returns:

The scheme name that should be used with this password storage scheme when it is used in the context of the authentication password syntax.

encodeAuthPassword

public abstract org.forgerock.opendj.ldap.ByteString encodeAuthPassword(org.forgerock.opendj.ldap.ByteSequence plaintext)
                                                                 throws DirectoryException

Encodes the provided plaintext password for this storage scheme using the authentication password syntax defined in RFC 3112. Note that the provided plaintext password should not be altered in any way.

Parameters:

plaintext - The plaintext version of the password.

Returns:

The password that has been encoded in the authentication password syntax.

Throws:

DirectoryException - If a problem occurs while processing of if this storage scheme does not support the authentication password syntax.

authPasswordMatches

public abstract boolean authPasswordMatches(org.forgerock.opendj.ldap.ByteSequence plaintextPassword,
                                            String authInfo,
                                            String authValue)

Indicates whether the provided plaintext password matches the encoded password using the authentication password syntax with the given authInfo and authValue components.

Parameters:

plaintextPassword - The plaintext password provided by the user.

authInfo - The authInfo component of the password encoded in the authentication password syntax.

authValue - The authValue component of the password encoded in the authentication password syntax.

Returns:

true if the provided plaintext password matches the encoded password according to the authentication password info syntax, or false if it does not or this storage scheme does not support the authentication password syntax.

isReversible

public abstract boolean isReversible()

Indicates whether this storage scheme is reversible (i.e., it is possible to obtain the original plaintext value from the stored password).

Returns:

true if this is a reversible password storage scheme, or false if it is not.

getPlaintextValue

public abstract org.forgerock.opendj.ldap.ByteString getPlaintextValue(org.forgerock.opendj.ldap.ByteSequence storedPassword)
                                                                throws DirectoryException

Retrieves the original plaintext value for the provided stored password. Note that this should only be called if isReversible returns true.

Parameters:

storedPassword - The password for which to obtain the plaintext value. It should not include the scheme name in curly braces.

Returns:

The plaintext value for the provided stored password.

Throws:

DirectoryException - If it is not possible to obtain the plaintext value for the provided stored password.

getAuthPasswordPlaintextValue

public abstract org.forgerock.opendj.ldap.ByteString getAuthPasswordPlaintextValue(String authInfo,
                                                                                   String authValue)
                                                                            throws DirectoryException

Retrieves the original plaintext value for the provided password stored in the authPassword syntax. Note that this should only be called if isReversible returns true.

Parameters:

authInfo - The authInfo component of the password encoded in the authentication password syntax.

authValue - The authValue component of the password encoded in the authentication password syntax.

Returns:

The plaintext value for the provided stored password.

Throws:

DirectoryException - If it is not possible to obtain the plaintext value for the provided stored password, or if this storage scheme does not support the authPassword syntax..

isStorageSchemeSecure

public abstract boolean isStorageSchemeSecure()

Indicates whether this password storage scheme should be considered "secure". If the encoding used for this scheme does not obscure the value at all, or if it uses a method that is trivial to reverse (e.g., base64), then it should not be considered secure.

This may be used to determine whether a password may be included in a set of search results, including the possibility of overriding access controls in the case that access controls would allow the password to be returned but the password is considered too insecure to reveal.

Returns:

false if it may be trivial to discover the original plain-text password from the encoded form, or true if the scheme offers sufficient protection that revealing the encoded password will not easily reveal the corresponding plain-text value.