SEC-2662: Handle Password Policy Error status CHANGE_AFTER_RESET

Jürgen Failenschmid (Migrated from SEC-2662) said:

The Password Policy LDAP control/response is handled better since Spring Security 3.0. The decoding of responses includes org.springframework.security.ldap.ppolicy.PasswordPolicyErrorStatus#CHANGE_AFTER_RESET.

However, org.springframework.security.ldap.authentication.BindAuthenticator does not deal with error status CHANGE_AFTER_RESET after getContext(). Instead, it still attempts to retrieve all attributes of the LDAP entry, which causes a NamingException (LDAP error 50). Only limited LDAP operations are allowed at that point, for example, the ModifyPassword operation.

Our application requires that the user is able to change the password without relying on an administrator. This can only happen if the user is able to establish a session, albeit with limited authority.

As a work-around I tried to extend BindAuthenticator, but unfortunately its method bindWithDn() is private, so I had to copy the method authenticate() and make a modified copy of bindWithDn() in order to avoid the exception.

It would be best if BindAuthenticator supported CHANGE_AFTER_RESET, or at least provide a straightforward way to extend the handling of password policy responses.

Start with org.springframework.security.ldap.authentication.BindAuthenticator, especially authenticate() and the private bindWithDn() path, and trace how PasswordPolicyErrorStatus.CHANGE_AFTER_RESET is handled after getContext(). Done means this status no longer triggers the LDAP attribute-retrieval NamingException and supports a limited session for changing the password.