Check whether PasswordExpired in Acitve Directory via JNDI/LDAP

[Hari Tantry]

Hi all,
I am using JNDI/LDAP to connect with Active Directory.
Now my problem is that i needed to display to the user that his/her Password has expired when the user tries binding with the AD Server.
I have written the following piece of code, please can u check whether this approach is fine or is there a better way to do the same:
*****************************************************
if (ne instanceof AuthenticationException)
{
String tempString;
StringTokenizer tokenizerTemp = new StringTokenizer(ne.toString());
while (tokenizerTemp.hasMoreElements())
{
tempString = tokenizerTemp.nextToken();
if (tempString.equalsIgnoreCase("data"))
{
while (tokenizerTemp.hasMoreElements())
{
tempString = tokenizerTemp.nextToken();
if (tempString.startsWith(DATA_PWD_EXPIRED))
{
throw new FailedLoginException(properties.getString("module.activedirectory.error.passwordExpired"));
}

}
}
}
}
***************************************************************
Well this piece of code sits in the catch block and retrieves the info from the error string which is thrown something like this....

javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr:
DSID-0C09030B, comment: AcceptSecurityContext error, data 775, v893 ]
at com.sun.jndi.ldap.LdapCtx.mapErrorCode(Unknown Source)
at com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source)
at com.sun.jndi.ldap.LdapCtx.processReturnCode(Unknown Source)
at com.sun.jndi.ldap.LdapCtx.connect(Unknown Source)
at com.sun.jndi.ldap.LdapCtx.<init>(Unknown Source)
at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(Unknown Source)
at javax.naming.spi.NamingManager.getInitialContext(Unknown Source)
at javax.naming.InitialContext.getDefaultInitCtx(Unknown Source)
at javax.naming.InitialContext.init(Unknown Source)
at javax.naming.InitialContext.<init>(Unknown Source)
at javax.naming.directory.InitialDirContext.<init>(Unknown Source)
at TestLDAP.main(TestLDAP.java:39)
All u people please advice,

Infact i had thought of one more approach of retrieving the "PwdLastSet" attribiute from AD.
Then actually the problem was that we will need the "maxPwdAge" to retrieve to check the password expiry....since the "maxPwdAge" attribute is defined in the Global Catalog level i cannot connect and retrieve that value.

Regards,
Hari

[Hari Tantry]

sorry,
if (tempString.startsWith(DATA_PWD_EXPIRED))
{
throw new FailedLoginException(properties.getString("module.activedirectory.error.passwordExpired"));
}

should read...
if (tempString.startsWith("773"))
{
throw new FailedLoginException(properties.getString("module.activedirectory.error.passwordExpired"));
}
Regards
Hari

[Hari Tantry]

i have found a other way out for the problem

[arun prasad]

Hello Hari,
Can you please explain the other solution for that problem?

Arun