eDirectory: enable NMAS Challenge-Response over LDAP

[GoogleCodeExporter]

PWM is able to use the NMAS Challenge-Response mechanism for forgotten password 
functionality with eDirectory. 
Currently, PWM requires User Application (RBPM) webservices in order to 
accomplish this. Customers are forced to deploy RBPM. 

However, it is possible to use NMAS over LDAP, thus eliminating the RBPM 
requirement from PWM. 

The attached patch file patches PWM trunk so it can use NMAS CR over LDAP only. 
Please review this patch for acceptance into PWM. 

Regards,

Mark

Original issue reported on code.google.com by mvre...@idfocus.nl on 24 May 2013 at 7:49

Attachments:

• PWM-NMAS-20130523-2309.patch

[GoogleCodeExporter]

Please note, that there is one restriction currently: if using secure LDAP, the 
CA certificate must be imported into the default java keystore (usually 
cacerts). 

I am looking at ways to circumvent this. 

Original comment by mvre...@idfocus.nl on 24 May 2013 at 9:12

[GoogleCodeExporter]

Excellent!  Thank you for your contribution.  I will evaluate and add as 
appropriate, thought it may take some time.

Original comment by jrivard on 28 May 2013 at 1:24

• Changed state: Accepted
• Added labels: Type-Enhancement
• Removed labels: Type-Help

[GoogleCodeExporter]

Just to let you know: we've hired Mark to develop this code as it would be 
really nice to remove the dependency on UA webservices. I currently have it up 
and running and it needs some more testing. We'll probably find some bugs as we 
go along and do some better Exception Handling as well.

The above code is currently a Proof of Concept.

Original comment by sebastia...@gmail.com on 28 May 2013 at 7:35

[GoogleCodeExporter]

In the mean time I have created an updated version of the patch which solves 
many issues. 
Since the earlier patch file seems to have some issues, the raw source files 
are attached. 

Original comment by mvre...@idfocus.nl on 4 Jun 2013 at 8:25

Attachments:

• PWM-NMAS-sourcefiles-20130604-2215.zip

[GoogleCodeExporter]

Just FYI, there is a separate similar implementation that will likely end up in 
the codebase instead, mostly because it integrates with another big merge I'm 
doing, although it has drawn some inspiration from this work, so its not all 
for nothing...  I hope to be able to commit it soon.

Original comment by jrivard on 4 Jun 2013 at 8:34

[GoogleCodeExporter]

Please note that the nmasclient.jar distributed with PWM is missing an 
important method for this patch. The attached, updated nmasclient.jar should be 
used to test this. 

Original comment by mvre...@idfocus.nl on 4 Jun 2013 at 8:35

Attachments:

• nmasclient.jar