Decode ASN.1/BER response from PasswordPolicyResponse (openldap)

Question

By using a connection request control (PasswordPolicyControl) I manage to get a response from OpenLDAPs password policy (OID: 1.3.6.1.4.1.42.2.27.8.5.1).
The response is encoded by ASN.1/BER and is probably (?) following the draft-behera-ldap-password-policy-09.txt (http://www.ietf.org/internet-drafts/draft-behera-ldap-password-policy-09.txt) page 20.
Is there anybody out there who has already written a BERdecoder that works with OpenLDAPs passwordpolicyresponse? I tried using the code written for the IBM tivoli server (http://www-128.ibm.com/developerworks/tivoli/library/t-ldap-controls/), but I couldn't get the decoding correct.
Thanks in advance.
J�rgen L�kke

Answer 1

few posts from openldap.org to help explain some potenial problems with password policy:
http://www.openldap.org/lists/openldap-software/200606/msg00220.html
http://www.openldap.org/lists/openldap-software/200606/msg00287.html
versions prior to 2.3.22 that supported ppolicy have PasswordPolicyResponseControl tag value of 0xA1 and not 0xA0.. so you need 2.3.22+
Tried to use Netscape library class JDAPBERTagDecoder, but it didn't handle tag 0x81
http://www.koders.com/java/fid5DD86A39A82ED753BAEC53E84A001BE4D6C6ADF5.aspx?s=JdapBERTagDecoder
so slightly modified a version of it...
and handled case..
            case 0x81:  /* Context Specific <Construct> [0]:
                 * v3 Server Control.
                 * SEQUENCE of SEQUENCE of {OID  [critical] [value]}
                 * THIS IS ERROR FROM PASSWORD CONTROL
                element = new BERInteger(stream, bytesRead);
                implicit[0] = true;
            break;..
more of that file..
public class OpenLdapBERTagDecoder extends BERTagDecoder
    public BERElement getElement (BERTagDecoder decoder, int tag, InputStream stream, int[] bytesRead,
        boolean[] implicit) throws IOException
        BERElement element = null;
        switch (tag) {
            case 0x60:  /* [APPLICATION 0] For Bind Request */
            case 0x61:  /* [APPLICATION 1] Bind Response */
            case 0x63:  /* [APPLICATION 3] Search Request
                         * If doing search without bind first,
                 * x500.arc.nasa.gov returns tag [APPLICATION 3]
                 * in Search Response. Gee.
            case 0x64:  /* [APPLICATION 4] Search Response */
            case 0x65:  /* [APPLICATION 5] Search Result */
            case 0x67:  /* [APPLICATION 7] Modify Response */
            case 0x69:  /* [APPLICATION 9] Add Response */
            case 0x6a:  /* [APPLICATION 10] Del Request */
            case 0x6b:  /* [APPLICATION 11] Del Response */
            case 0x6d:  /* [APPLICATION 13] ModifyRDN Response */
            case 0x6f:  /* [APPLICATION 15] Compare Response */
            case 0x78:  /* [APPLICATION 23] Extended Response */
            case 0x73:  /* [APPLICATION 19] SearchResultReference */
                element = new BERSequence(decoder, stream, bytesRead);
                implicit[0] = true;
            break;
            case 0x80:  /* [APPLICATION 16] 64+16 */
                element = new BERInteger(stream, bytesRead);
                implicit[0] = true;
            break;
            /* 16/02/97 MS specific */
            case 0x85:  /* Context Specific [5]:
                 * (a) Handle Microsoft v3 referral bugs! (Response)
                 * (b) Handle Microsoft v3 supportedVersion in Bind
                 *     response
                element = new BERInteger(stream, bytesRead);
                implicit[0] = true;
            break;
            case 0x87:  /* Context Specific [7]:
                 * Handle Microsoft Filter "present" in
                 * search request.
                element = new BEROctetString(decoder, stream, bytesRead);
                implicit[0] = true;
            break;
            case 0x8a:  /* Context Specific [10]:
                         * Handle extended response
                element = new BEROctetString(decoder, stream, bytesRead);
                implicit[0] = true;
            break;
            case 0x8b:  /* Context Specific [11]:
                         * Handle extended response
                element = new BEROctetString(decoder, stream, bytesRead);
                implicit[0] = true;
            break;
            case 0xa3:  /* Context Specific <Construct> [3]:
                 * Handle Microsoft v3 sasl bind request
                element = new BERSequence(decoder, stream, bytesRead);
                implicit[0] = true;
            break;
            case 0xa7:  /* Context Specific <Construct> [7]:
                 * Handle Microsoft v3 serverCred in
                 * bind response. MS encodes it as SEQUENCE OF
                 * while it should be CHOICE OF.
                element = new BERSequence(decoder, stream, bytesRead);
                implicit[0] = true;
            break;
            case 0xa0:  /* Context Specific <Construct> [0]:
                 * v3 Server Control.
                 * SEQUENCE of SEQUENCE of {OID  [critical] [value]}
                 * THIS IS WARNING FROM PASSWORD CONTROL
                element = new BERSequence(decoder, stream, bytesRead);
                implicit[0] = true;
            break;
            case 0x81:  /* Context Specific <Construct> [0]:
                 * v3 Server Control.
                 * SEQUENCE of SEQUENCE of {OID  [critical] [value]}
                 * THIS IS ERROR FROM PASSWORD CONTROL
                element = new BERInteger(stream, bytesRead);
                implicit[0] = true;
            break;
            case 0xa1:  /* Context Specific <Construct> [0]:
                 * v3 Server Control.
                 * SEQUENCE of SEQUENCE of {OID  [critical] [value]}
                element = new BERSequence(decoder, stream, bytesRead);
                implicit[0] = true;
            break;
            default:
                throw new IOException("Tag ID not recognised "+Integer.toHexString(tag));
        return element;       
    }had to slightly modify examples from
http://www-128.ibm.com/developerworks/tivoli/library/t-ldap-controls/ to get openldap working
    public Control getControlInstance (Control ctl)
        Control result = null;
        if (ctl.getID().equals( PasswordPolicyControl.OID ))
            try
                final PasswordPolicyResponseControl rctl = new PasswordPolicyResponseControl();
                if (ctl.getEncodedValue() != null)
                    rctl.setEncodedValue( ctl.getEncodedValue() );
                    ByteArrayInputStream inStream = new ByteArrayInputStream( ctl.getEncodedValue() );
                    OpenLdapBERTagDecoder decoder = new OpenLdapBERTagDecoder();
                    int[] nRead = new int[1];
                    nRead[0] = 0;
                    /* A Sequence */
                    BERSequence aSeq = (BERSequence) BERElement.getElement(decoder,inStream,nRead);
                    for (int i = 0; i < aSeq.size(); i++)
                        handleSequenceElement( aSeq.elementAt( i ), rctl );
                result = rctl;
            catch (IOException e)
                LOG.info( e );
        return result;
protected void handleSequenceElement (BERElement element, PasswordPolicyResponseControl target)
        final BERTag tag = (BERTag) element;
        // warning -- Haven't checked warning code - but  suspect it mightn't work!!!!
        if ((tag.getTag() ^ BERTag.CONTEXT) == 0)
            BERSequence sequence = (BERSequence) tag.getValue();
            final BERTag elem = (BERTag) sequence.elementAt( 0 );
            sequence = (BERSequence) elem.getValue();
            final BERInteger intValue = (BERInteger) sequence.elementAt( 0 );
            if ((elem.getTag() ^ BERTag.CONTEXT) == 0)
                target.setTimeBeforeExpiration( intValue.getValue() );
            if ((elem.getTag() ^ BERTag.CONTEXT) == 1)
                target.setGraceLoginsRemaining( intValue.getValue() );
        // error - THIS WORKS see openldap.org link above
        if ((tag.getTag() ^ BERTag.CONTEXT) == 1)
            //final BERSequence sequence = (BERSequence) tag.getValue();
            //final BEREnumerated berEnum = (BEREnumerated) sequence.elementAt( 0 );
            //target.setErrorCode( berEnum.getValue() );
            final BERInteger berInteger = (BERInteger) tag.getValue();
            target.setErrorCode( berInteger.getValue() );
    }