Reconnect, Expired Password and Grace Logon

Question

Hi I am trying to find a better way of implementing grace logons when a password has expired in a web application. The problem is the LdapContext is not serializable therefore we cannot put it in an HTTP Session and allow clusterability. Also storing the user ID/password in order to recreate the context in the session would not help as recreating the context would use up a grace logon.
In two projects I have done with the workarounds of increasing the grace login limit from n to 2n+1 (basically 1 login to get through the login page, and another login to change the password allowing for 2 tries in case they reused their old password).
The other more recent one I just stored the Context in the HTTP Session with the caveat that the application may not be clustered. I have documented it earlier in http://www.trajano.net/2007/04/ldap-logon-and-password-management.html
The test case I wanted to do was something like this:
Serializable someSerialiazableObject;
  HashTable envWithAuthData = new HashTable();
  envWithAuthData.put(Context.PROVIDER_URL, providerURL);
  envWithAuthData.put(Context.SECURITY_PRINCIPAL, userDN);
  envWithAuthData.put(Context.SECURITY_CREDENTIALS, userPassword);
  envWithAuthData.put(Context.SECURITY_AUTHENTICATION, "simple");
  LdapContext c = new InitialLdapContext(envWithAuthData, null);
  // THIS DOES NOT EXIST
  someSerialiazableObject = c.getSomeReconnectionData();
  HashTable envWithNoAuthData = new HashTable();
  envWithNoAuthData.put(Context.PROVIDER_URL, providerURL);
  envWithNoAuthData.put("ReconnectData", someSerialiazableObject);
  LdapContext c = new InitialLdapContext(envWithAuthData, null);
  c.operationThatCanOnlyBeDoneByAnAuthenticatedUser();
}I have tried looking at reconnect, getRequestControl etc, but I am not able to find any useful information.

Answer 1

Though it is not a full solution, utilizing Proxy Authorization can get me past a few issues. Howeevr, it is not available with every directory server, I would much like it if it were possible to do it in a more vendor neutral fashion.
[http://www.ibm.com/developerworks/tivoli/library/t-ldappatds/index.html|
The code that is in there does not seem to work with Apache DS