SEC-2663: Handle Password Policy Error status PASSWORD_EXPIRED

Jürgen Failenschmid (Migrated from SEC-2663) said:

The Password Policy LDAP control/response is handled better since Spring Security 3.0. The decoding of responses includes org.springframework.security.ldap.ppolicy.PasswordPolicyErrorStatus#PASSWORD_EXPIRED and ACCOUNT_LOCKED.

However, org.springframework.security.ldap.ppolicy.PasswordPolicyAwareContextSource only checks ACCOUNT_LOCKED (ctrl.isLocked) and ignores PASSWORD_EXPIRED (ctrl.isExpired).

As a work-around I tried to override PasswordPolicyAwareContextSource.getContext(), but that is inefficient because by the time the LdapException can be caught, the directory context is already closed and would have to be opened again in order to retrieve the password policy control response. Therefore, I made a modified copy of the getContext() method to add checking for isExpired().
Note that the current implementation of org.springframework.security.ldap.authentication.LdapAuthenticationProvider assumes that the PasswordPolicyException will be thrown only in the case of ACCOUNT_LOCKED. So, I ended up throwing the CredentialsExpiredException directly from my extension of PasswordPolicyAwareContextSource.

It would be best if PasswordPolicyAwareContextSource supported PASSWORD_EXPIRED, or at least provided a straightforward way to extend the handling of password policy responses.

Start by reading PasswordPolicyAwareContextSource.getContext() and the handling in LdapAuthenticationProvider, focusing on PasswordPolicyErrorStatus.PASSWORD_EXPIRED versus ACCOUNT_LOCKED. Trace how the password policy response is available before the directory context closes. Done means expired-password responses are handled alongside locked accounts without requiring a custom copy of getContext().