[Catalyst] Password policy support for Catalyst::Authentication::Store::LDAP

[Matt S Trout]

On Fri, Jun 20, 2008 at 06:46:02PM +0200, Buchan Milne wrote:
> On Friday 20 June 2008 12:20:49 Gavin Henry wrote:
> > 2008/6/20 Buchan Milne <bgmilne at mandriva.org>:
> > > In our internal management web app (which has only been feasible due to
> > > Catalyst), we authenticate against our OpenLDAP (2.3) infrastructure.
> > >
> > > Due to various security requirements (SAOX etc.), we are required to have
> > > password expiration etc. So, we implemented password policies a while
> > > back using OpenLDAP's slapo-ppolicy overlay
> > > (http://www.openldap.org/software/man.cgi?query=slapo-ppolicy&sektion=5&a
> > >propos=0&manpath=OpenLDAP+2.3-Release)
> > >
> > > Net::LDAP recently added support for the Password Policy control, so at
> > > least this is now feasible (without hacking Net::LDAP, which is where I
> > > got stuck on the previous attempt).
> > >
> > > I think I may be able to provide a patch for Authentication::Store::LDAP,
> > > however, the first problem is that Catalyst::Authentication (like many
> > > other authentication frameworks) assumes the result of an authentication
> > > will always only be a boolean, and thus doesn't make provision for
> > > situations such as:
> > > -The account is locked out (the password may have been correct, but the
> > > user can't authenticate)
> > > -The password was reset and needs to be changed (so, authenticate them
> > > but allow for a means to send them to a password changing facility)
> > > -The password will expire soon
> > > etc.
> > >
> > > I wouldn't like to try and propose a solution for
> > > Catalyst::Authentication (yet), but I can try and provide input on any
> > > proposed solution.
> >
> > Can't you still return a true/false and then provide/use an error
> > method which will then contain the reason for failure, which include
> > the response from ppolicy?
> 
> In theory, yes (from Store::LDAP), but I want to get something back from 
> login(), which just checks the boolean it gets back from the store (I think, 
> don't have anything in front of me now).

New-style auth uses authenticate().

I -think- it should be possible for any true value to be passed back out,
so instead of 'return 1' you could return an object that describes the
current status of the account?

-- 
      Matt S Trout       Need help with your Catalyst or DBIx::Class project?
   Technical Director                    http://www.shadowcat.co.uk/catalyst/
 Shadowcat Systems Ltd.  Want a managed development or deployment platform?
http://chainsawblues.vox.com/            http://www.shadowcat.co.uk/servers/