Skip to main content

How to catch the AD password expired/locked situation by WSO2IS

Solution: you have to write your own custom user store.

When the password expired or account locked from the AD level, AD returns an error codes [1] to the IS. That error code you can catch in the customer user store and implement your own logic to fulfilling your requirement.
49 / 532 PASSWORD_EXPIRED
49 / 533 ACCOUNT_DISABLED
[1] http://wiki.servicenow.com/index.php?title=LDAP_Error_Codes#gsc.tab=0

So, create a new class extending org.wso2.carbon.user.core.ldap.ActiveDirectoryUserStoreManager [2], and it will let you to override the doAuthenticate() method which derived from ReadOnlyLDAPUserStoreManager [3]. Note that you need to implement bindAsUser() method, and catch the AuthenticationException which throws when the password expired or account locked from the AD level and based on that you can implement your own logic.

You can see the error codes thrown from AD to IS when enabling DEBUG logs in org.wso2.carbon.user.core component.
For this you need to navigate to [IS_HOME]/repository/conf directory and add the following entry to log4j.properties file and save it.


Then restart the server and try to login with password expired or account locked user. You can see the error codes in [IS_HOME]/repository/logs/wso2carbon.log file
[2] https://svn.wso2.org/repos/wso2/carbon/kernel/branches/4.2.0/patches/patch0010/core/org.wso2.carbon.user.core/4.2.0/src/main/java/org/wso2/carbon/user/core/ldap/ActiveDirectoryUserStoreManager.java
[3] https://svn.wso2.org/repos/wso2/carbon/kernel/branches/4.2.0/patches/patch0010/core/org.wso2.carbon.user.core/4.2.0/src/main/java/org/wso2/carbon/user/core/ldap/ReadOnlyLDAPUserStoreManager.java

Refer [4] which will help you on how to write a custom user store manager and deploying the same. After deployment and restarting the server verify whether your scenario works as expected.
[4] https://docs.wso2.com/display/IS500/Writing+a+Custom+User+Store+Manager#WritingaCustomUserStoreManager-Writingthecustomuserstoremanager


Refer [5] the sample CustomUserStoreManager code base which will help you identifying the structure you need to implement your class. ( You can download this source and adhere to this structure when writing your own implementation)
[5] https://svn.wso2.org/repos/wso2/people/pushpalanka/SampleCustomeUserStoreManager-5.0.0/src/main/java/org/wso2/sample/user/store/manager/CustomUserStoreManager.java
Labels:

Comments

Post a Comment

Popular posts from this blog

Create Application in WSO2 App Cloud via REST API

This blog post gives you some examples on how to use createApplication REST API correctly in WSO2 App Cloud  https://docs.wso2.com/display/AppCloud/Published+APIs Before invoke createApplication API, you need to login to the WSO2 App Cloud and get the session cookie. curl -c cookies -v -k -X POST -k https://apps.cloud.wso2.com/appmgt/site/blocks/user/login/ajax/login.jag -d 'action=login&userName=amalka.wso2.com@<tenant>&password=<password>’ This are some basic example to create applications in WSO2 App Cloud. Create application via upload from file system curl -v -k -b cookies -X POST https://apps.cloud.wso2.com/appmgt/site/blocks/application/application.jag -F action=createApplication -F applicationName=SampleFile -F applicationDescription=desc -F runtime=1 -F appTypeName=war -F applicationRevision=1.0.0 -F uploadedFileName=sample.war -F runtimeProperties=[] -F tags=[]  -F fileupload=@/home/amalka/Downloads/sample.war -F isFileAttached=t...
Post a Comment
Read more

Send email via WSO2 ESB with several attachments

WSO2 ESB Mail transport allows you to send a email only with 1 attachment. If you want to send number of attachments here's the solution. Scenario: Here I want to extract some content from the input message and attach to the email as two different attachment. Solution:  You can achieve this requirement using Gmail connector. Steps:  Add the Gmail connector to the ESB and enable it. You can download the esb connector here https://storepreview.wso2.com/store/assets/esbconnector/a1fba975-89fb-4bb0-a1b9-9f9d061fb31c Add it to the ESB and enable it https://docs.wso2.com/display/ESB481/Managing+Connectors+in+Your+ESB+Instance Gmail connector documentation https://docs.wso2.com/display/ESBCONNECTORS/Gmail+Connector Setup the scenario: split the input message and send it with an email using two different attachments. Input message I used <email>         <username>sender@gmail.com<...
2 comments
Read more

How to generate random unique number in SOAP UI request

eg 1: ${=System.currentTimeMillis() + ((int)(Math.random()*10000))} eg 2: ${=java.util.UUID.randomUUID()} ${=java.util.UUID.randomUUID()} ${=System.currentTimeMillis() + ((int)(Math.random()*10000))} - See more at: http://tryitnw.blogspot.com/2014/03/generating-random-unique-number-in-soap.html#sthash.m2S4tUFu.dpuf ${=System.currentTimeMillis() + ((int)(Math.random()*10000))} - See more at: http://tryitnw.blogspot.com/2014/03/generating-random-unique-number-in-soap.html#sthash.m2S4tUFu.dpuf ${=System.currentTimeMillis() + ((int)(Math.random()*10000))} - See more at: http://tryitnw.blogspot.com/2014/03/generating-random-unique-number-in-soap.html#sthash.m2S4tUFu.dpuf
Post a Comment
Read more