Package org.opends.server.extensions

Class AESPasswordStorageScheme

  • public final class AESPasswordStorageScheme
extends PasswordStorageScheme<C>
    This class defines a Directory Server password storage scheme that will encode values using the AES reversible encryption algorithm. This implementation supports only the user password syntax and not the auth password syntax.

    • Constructor Detail

      • AESPasswordStorageScheme

        public AESPasswordStorageScheme()
        Default ctor.

    • Method Detail

      • initializePasswordStorageScheme

        public void initializePasswordStorageScheme​(C configuration,
                                            ServerContext serverContext)
        Description copied from class: PasswordStorageScheme
        Initializes this password storage scheme handler based on the information in the provided configuration entry. It should also register itself with the Directory Server for the particular storage scheme that it will manage.
        Specified by:
        initializePasswordStorageScheme in class PasswordStorageScheme<C extends PasswordStorageSchemeCfg>
        Parameters:
        configuration - The configuration entry that contains the information to use to initialize this password storage scheme handler.
        serverContext - The server context

      • passwordMatches

        public boolean passwordMatches​(ByteString plaintextPassword,
                               ByteString storedPassword)
        Description copied from class: PasswordStorageScheme
        Indicates whether the provided plaintext password included in a bind request matches the given stored value. The provided stored value should not include the scheme name in curly braces.
        Specified by:
        passwordMatches in class PasswordStorageScheme<C extends PasswordStorageSchemeCfg>
        Parameters:
        plaintextPassword - The plaintext password provided by the user as part of a simple bind attempt.
        storedPassword - The stored password to compare against the provided plaintext password.
        Returns:
        true if the provided plaintext password matches the provided stored password, or false if not.

      • getPlaintextValue

        public ByteString getPlaintextValue​(ByteString storedPassword)
                             throws LdapException
        Description copied from class: PasswordStorageScheme
        Retrieves the original plaintext value for the provided stored password. Note that this should only be called if isReversible returns true.
        Overrides:
        getPlaintextValue in class PasswordStorageScheme<C extends PasswordStorageSchemeCfg>
        Parameters:
        storedPassword - The password for which to obtain the plaintext value. It should not include the scheme name in curly braces.
        Returns:
        The plaintext value for the provided stored password.
        Throws:
        LdapException - If it is not possible to obtain the plaintext value for the provided stored password.

      • isReversible

        public boolean isReversible()
        Description copied from class: PasswordStorageScheme
        Indicates whether this storage scheme is reversible (i.e., it is possible to obtain the original plaintext value from the stored password).
        Overrides:
        isReversible in class PasswordStorageScheme<C extends PasswordStorageSchemeCfg>
        Returns:
        true if this is a reversible password storage scheme, or false if it is not.

      • isStorageSchemeSecure

        public boolean isStorageSchemeSecure()
        Description copied from class: PasswordStorageScheme
        Indicates whether this password storage scheme should be considered "secure". If the encoding used for this scheme does not obscure the value at all, or if it uses a method that is trivial to reverse (e.g., base64), then it should not be considered secure.

        This may be used to determine whether a password may be included in a set of search results, including the possibility of overriding access controls in the case that access controls would allow the password to be returned but the password is considered too insecure to reveal.
        Specified by:
        isStorageSchemeSecure in class PasswordStorageScheme<C extends PasswordStorageSchemeCfg>
        Returns:
        false if it may be trivial to discover the original plain-text password from the encoded form, or true if the scheme offers sufficient protection that revealing the encoded password will not easily reveal the corresponding plain-text value.