Make password expiration time attribute configurable

[edvalley]

As the title says...
Thanks for your time and your great project

[jrivard]

In what case and ldap vendor does this need to be configurable? is the chai readPasswordExpirationTime not working? If so we should fix chai, not make an override in PWM.... Can you give more background on this issue?

[edvalley]

In what case and ldap vendor does this need to be configurable? is the chai readPasswordExpirationTime not working? If so we should fix chai, not make an override in PWM.... Can you give more background on this issue?

FreeIPA uses the attribute krbPasswordExpiration, chai readPasswordExpirationTime() uses passwordExpirationTime. It's a generic and simple solution without adding Chai full support for FreeIPA.

[edvalley]

@jrivard: To make this PR really complete, I'll also need to change code calling chai isPasswordExpired(). I think you're right, we should fix chai's implementation. FreeIPA uses 389 DS as LDAP backend, which chai already support, but some attribute names are specific to FreeIPA. I'll close this PR and open an issue in ldapchai to discuss about adding FreeIPA support. Do you think it's the right way to go?

[jrivard]

Yes, I think that's a better approach. As each directory varies in more than just the attribute name for this logic, the time syntax can be different, and other logic.

In this case, the krbPasswordExpiration seems to be a "secondary" attribute, possibly present on all FreeIPA instances but I don't think its part of the standard DS389 schema. So my guess would be you probably want both attributes read, and if either is present use it, if both are present prioritize one or take the largest value.... I'm not sure, but from the reading and trials I've done against the FreeIPA demo server that seems like it might work.

Also, I just added a DIRECTORY_SERVER_389 setting template to PwmSetting.xml so we can have appropriate default setting values for DS389 in PWM, and I have fixed the readGUID method in chai to read nsUniqueId attribute.