UnboundID Server SDK

Ping Identity
UnboundID Server SDK Documentation

InternalOperationAttachmentSASLMechanismHandler.java

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License, Version 1.0 only
 * (the "License").  You may not use this file except in compliance
 * with the License.
 *
 * You can obtain a copy of the license at
 * docs/licenses/cddl.txt
 * or http://www.opensource.org/licenses/cddl1.php.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at
 * docs/licenses/cddl.txt.  If applicable,
 * add the following below this CDDL HEADER, with the fields enclosed
 * by brackets "[]" replaced with your own identifying information:
 *      Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 *
 *
 *      Portions Copyright 2019-2023 Ping Identity Corporation
 */
package com.unboundid.directory.sdk.examples;



import java.util.Arrays;
import java.util.Collections;
import java.util.List;
import java.util.Map;

import com.unboundid.asn1.ASN1OctetString;
import com.unboundid.directory.sdk.common.operation.SASLBindRequest;
import com.unboundid.directory.sdk.common.operation.UpdatableSASLBindRequest;
import com.unboundid.directory.sdk.common.operation.UpdatableSimpleBindRequest;
import com.unboundid.directory.sdk.common.types.LogSeverity;
import com.unboundid.directory.sdk.common.types.OperationContext;
import com.unboundid.directory.sdk.common.types.ServerContext;
import com.unboundid.directory.sdk.ds.api.SASLMechanismHandler;
import com.unboundid.directory.sdk.ds.config.SASLMechanismHandlerConfig;
import com.unboundid.directory.sdk.ds.types.DirectoryServerContext;
import com.unboundid.directory.sdk.ds.types.SASLBindResult;
import com.unboundid.directory.sdk.ds.types.SASLBindResultFactory;
import com.unboundid.ldap.sdk.Control;
import com.unboundid.ldap.sdk.DN;
import com.unboundid.ldap.sdk.LDAPException;
import com.unboundid.ldap.sdk.ResultCode;
import com.unboundid.util.ByteString;
import com.unboundid.util.StaticUtils;
import com.unboundid.util.Validator;
import com.unboundid.util.args.ArgumentParser;



/**
 * This class provides a Server SDK SASL mechanism handler implementation that
 * uses attachments on the associated bind operation to specify the behavior
 * that the server should exhibit when processing the bind operation.  This is
 * only intended to be used internally within the server and should not be
 * directly requested by an external client.  It is primarily expected to be
 * used in conjunction with a pre-parse bind plugin that performs all of the
 * authentication processing itself, but then converts the bind request to this
 * mechanism to use the information provided in attachments to define the result
 * of the operation processing.
 * <BR><BR>
 * This SASL mechanism handler actually implements support for four related SASL
 * mechanisms:
 * <BR>
 * <UL>
 *   <LI>
 *      PING-SECURE-PASSWORD-BASED-INTERNAL-OPERATION-ATTACHMENT:  Indicates
 *      that the authentication used a password provided by the client, and that
 *      the password and any other associated credentials were provided in a
 *      secure manner (that is, in a manner that is not vulnerable to
 *      eavesdropping, replay, or alteration attacks).
 *   </LI>
 *   <LI>
 *      PING-NON-SECURE-PASSWORD-BASED-INTERNAL-OPERATION-ATTACHMENT:  Indicates
 *      that the authentication used a password provided by the client, and that
 *      the password or any other associated credentials were provided in a
 *      non-secure manner (that is, in a manner that may be vulnerable to
 *      eavesdropping, replay, or alteration attacks).
 *   </LI>
 *   <LI>
 *      PING-SECURE-NON-PASSWORD-BASED-INTERNAL-OPERATION-ATTACHMENT:  Indicates
 *      that the authentication did not use a password provided by the client,
 *      and that any credentials used were provided in a secure manner (that is,
 *      in a manner that is not vulnerable to eavesdropping, replay, or
 *      alteration attacks).
 *   </LI>
 *   <LI>
 *      PING-NON-SECURE-NON-PASSWORD-BASED-INTERNAL-OPERATION-ATTACHMENT:
 *      Indicates that the authentication did not use a password provided by the
 *      client, but that it did use credentials that were provided in a
 *      non-secure manner (that is, in a manner that may be vulnerable to
 *      eavesdropping, replay, or alteration attacks).
 *   </LI>
 * </UL>
 * <BR><BR>
 * All four SASL mechanisms implemented by this handler implement support for
 * the same set of operation attachments.  Supported attachments include:
 * <BR>
 * <UL>
 *   <LI>
 *     {@code internal-op-sasl-handler-authentication-succeeded} --  indicates
 *     whether the authentication attempt was successful.  This attachment is
 *     required, and its value must be a {@code java.lang.Boolean}.
 *   </LI>
 *   <LI>
 *     {@code internal-op-sasl-handler-diagnostic-message} -- a diagnostic
 *     message that should be included in the bind response to the client.  This
 *     attachment is optional and may be included regardless of whether the
 *     authentication attempt succeeded or failed.  If it is provided, then its
 *     value must be an instance of {@code java.lang.CharSequence}.
 *   </LI>
 *   <LI>
 *     {@code internal-op-sasl-handler-matched-dn} -- the matched DN value that
 *     should be included in the bind response to the client to indicate that a
 *     provided bind DN did not refer to an entry that exists in the server, and
 *     to provide the DN of its closest ancestor that does exist.  This
 *     attachment is optional and should only be used if the authentication
 *     attempt failed.  If it is provided, then its value must be an instance of
 *     {@code com.unboundid.ldap.sdk.DN}.
 *   </LI>
 *   <LI>
 *     {@code internal-op-sasl-handler-server-sasl-credentials} -- an encoded
 *     set of server SASL credentials that should be included in the bind
 *     response to the client.  This attachment is optional and should only be
 *     set if the original bind request was itself a SASL bind request and
 *     server SASL credentials are appropriate for that request.  If provided,
 *     the value of the attachment must be an instance of
 *     {@code com.unboundid.asn1.ASN1OctetString}.
 *   </LI>
 *   <LI>
 *     {@code internal-op-sasl-handler-response-controls} -- a set of controls
 *     that should be included in the bind response to the client.  This
 *     attachment is optional, and if it is not set, then the SASL mechanism
 *     handler will not add any controls to the response (although other
 *     components of the server may add response controls if appropriate for the
 *     operation).  If provided, the value of the attachment must be an instance
 *     of {@code com.unboundid.ldap.sdk.Control[]}.
 *   </LI>
 *   <LI>
 *     {@code internal-op-sasl-handler-bind-dn} -- the DN of the user
 *     attempting to authenticate.  This attachment must be set if the
 *     authentication is successful, and it will be set as the authentication
 *     identity for the associated connection (unless the bind request also
 *     included the retain identity request control).  Even if the bind attempt
 *     failed, this attachment should be set if it is possible to determine the
 *     identity of the user that was trying to authenticate so that any
 *     appropriate password policy state updates can be applied to that account.
 *     If provided, the value of the attachment must be an instance of
 *     {@code com.unboundid.ldap.sdk.DN}.
 *   </LI>
 *   <LI>
 *     {@code internal-op-sasl-handler-authentication-failure-reason} -- a
 *     message that will not appear in the bind response to the client, but will
 *     be included in the server's access log to provide additional information
 *     about the reason that the authentication attempt failed.  This attachment
 *     is optional and should only be used if the authentication attempt failed.
 *     If it is provided, then its value must be an instance of
 *     {@code java.lang.CharSequence}.
 *   </LI>
 *   <LI>
 *     {@code internal-op-sasl-handler-authorization-dn} -- the DN of the user
 *     that is the alternate authorization identity for the bind operation.
 *     This should only be set if the bind attempt succeeded and requested an
 *     alternate authorization identity.  If provided, the value of the
 *     attachment must be an instance of {@code com.unboundid.ldap.sdk.DN}.
 *   </LI>
 *   <LI>
 *     {@code internal-op-sasl-handler-password-used} -- the password that the
 *     client provided during the authentication attempt.  This attachment is
 *     optional and should only be used if the authentication attempt was
 *     successful and used a password.  If provided, the value of the attachment
 *     must be an instance of {@code com.unboundid.asn1.ASN1OctetString}.
 *   </LI>
 * </UL>
 */
public final class InternalOperationAttachmentSASLMechanismHandler
       extends SASLMechanismHandler
{
  /**
   * The name for the SASL mechanism that indicates that the authentication used
   * a password provided by the client, and that the password and any other
   * associated credentials were provided in a secure manner (that is, in a
   * manner that is not vulnerable to eavesdropping, replay, or alteration
   * attacks).
   */
  public static final String SECURE_PASSWORD_BASED_SASL_MECHANISM_NAME =
       "PING-SECURE-PASSWORD-BASED-INTERNAL-OPERATION-ATTACHMENT";



  /**
   * The name for the SASL mechanism that indicates that the authentication used
   * a password provided by the client, and that the password or any other
   * associated credentials were provided in a non-secure manner (that is, in a
   * manner that may be vulnerable to eavesdropping, replay, or alteration
   * attacks).
   */
  public static final String NON_SECURE_PASSWORD_BASED_SASL_MECHANISM_NAME =
       "PING-NON-SECURE-PASSWORD-BASED-INTERNAL-OPERATION-ATTACHMENT";



  /**
   * The name for the SASL mechanism that indicates that the authentication did
   * not use a password provided by the client, and that any credentials used
   * were provided in a secure manner (that is, in a manner that is not
   * vulnerable to eavesdropping, replay, or alteration attacks).
   */
  public static final String SECURE_NON_PASSWORD_BASED_SASL_MECHANISM_NAME =
       "PING-SECURE-NON-PASSWORD-BASED-INTERNAL-OPERATION-ATTACHMENT";



  /**
   * The name for the SASL mechanism that indicates that the authentication did
   * not use a password provided by the client, but that it did use credentials
   * that were provided in a non-secure manner (that is, in a manner that may be
   * vulnerable to eavesdropping, replay, or alteration attacks).
   */
  public static final String NON_SECURE_NON_PASSWORD_BASED_SASL_MECHANISM_NAME =
       "PING-NON_SECURE-NON-PASSWORD-BASED-INTERNAL-OPERATION-ATTACHMENT";



  /**
   * The name of the attachment used to indicate whether the authentication
   * attempt was successful.  This attachment is required, and its value must be
   * a {@code java.lang.Boolean}.
   */
  public static final String ATTACHMENT_NAME_AUTHENTICATION_SUCCEEDED =
       "internal-op-sasl-handler-authentication-succeeded";



  /**
   * The name of the attachment used to hold a diagnostic message that should be
   * included in the bind response to the client.  This attachment is optional
   * and may be included regardless of whether the authentication attempt
   * succeeded or failed.  If it is provided, then its value must be an instance
   * of {@code java.lang.CharSequence}.
   */
  public static final String ATTACHMENT_NAME_DIAGNOSTIC_MESSAGE =
       "internal-op-sasl-handler-diagnostic-message";



  /**
   * The name of the attachment used to hold the matched DN value that should be
   * included in the bind response to the client to indicate that a provided
   * bind DN did not refer to an entry that exists in the server, and to provide
   * the DN of its closest ancestor that does exist.  This attachment is
   * optional and should only be used if the authentication attempt failed.  If
   * it is provided, then its value must be an instance of
   * {@code com.unboundid.ldap.sdk.DN}.
   */
  public static final String ATTACHMENT_NAME_MATCHED_DN =
       "internal-op-sasl-handler-matched-dn";



  /**
   * The name of the attachment used to hold an encoded set of server SASL
   * credentials that should be included in the bind response to the client.
   * This attachment is optional and should only be set if the original bind
   * request was itself a SASL bind request and server SASL credentials are
   * appropriate for that request.  If provided, the value of the attachment
   * must be an instance of {@code com.unboundid.asn1.ASN1OctetString}.
   */
  public static final String ATTACHMENT_NAME_SERVER_SASL_CREDENTIALS =
       "internal-op-sasl-handler-server-sasl-credentials";



  /**
   * The name of the attachment used to hold a set of controls that should be
   * included in the bind response to the client.  This attachment is optional,
   * and if it is not set, then the SASL mechanism handler will not add any
   * controls to the response (although other components of the server may add
   * response controls if appropriate for the operation).  If provided, the
   * value of the attachment must be an instance of
   * {@code com.unboundid.ldap.sdk.Control[]}.
   */
  public static final String ATTACHMENT_NAME_RESPONSE_CONTROLS =
       "internal-op-sasl-handler-response-controls";



  /**
   * The name of the attachment used to hold the DN of the user attempting to
   * authenticate.  This attachment must be set if the authentication is
   * successful, and it will be set as the authentication identity for the
   * associated connection (unless the bind request also included the retain
   * identity request control).  Even if the bind attempt failed, this
   * attachment should be set if it is possible to determine the identity of the
   * user that was trying to authenticate so that any appropriate password
   * policy state updates can be applied to that account.  If provided, the
   * value of the attachment must be an instance of
   * {@code com.unboundid.ldap.sdk.DN}.
   */
  public static final String ATTACHMENT_NAME_BIND_DN =
       "internal-op-sasl-handler-bind-dn";



  /**
   * The name of the attachment used to hold a message that will not appear in
   * the bind response to the client, but will be included in the server's
   * access log to provide additional information about the reason that the
   * authentication attempt failed.  This attachment is optional and should only
   * be used if the authentication attempt failed.  If it is provided, then its
   * value must be an instance of {@code java.lang.CharSequence}.
   */
  public static final String ATTACHMENT_NAME_AUTHENTICATION_FAILURE_REASON =
       "internal-op-sasl-handler-authentication-failure-reason";



  /**
   * The name of the attachment used to hold the DN of the user that is the
   * alternate authorization identity for the bind operation.  This should only
   * be set if the bind attempt succeeded and requested an alternate
   * authorization identity.  If provided, the value of the attachment must be
   * an instance of {@code com.unboundid.ldap.sdk.DN}.
   */
  public static final String ATTACHMENT_NAME_AUTHORIZATION_DN =
       "internal-op-sasl-handler-authorization-dn";



  /**
   * The name of the attachment used to hold the password that the client
   * provided during the authentication attempt.  This attachment is optional
   * and should only be used if the authentication attempt was successful and
   * used a password.  If provided, the value of the attachment must be an
   * instance of {@code com.unboundid.asn1.ASN1OctetString}.
   */
  public static final String ATTACHMENT_NAME_PASSWORD_USED =
       "internal-op-sasl-handler-password-used";



  // A handle to the server context in which this extension is running.
  private volatile DirectoryServerContext serverContext = null;



  /**
   * Creates a new instance of this SASL mechanism handler.  All SASL
   * mechanism handler implementations must include a default constructor, but
   * any initialization
   * should generally be done in the {@code initializeSASLMechanismHandler}
   * method.
   */
  public InternalOperationAttachmentSASLMechanismHandler()
  {
    // No implementation is required.
  }



  /**
   * Retrieves a human-readable name for this extension.
   *
   * @return  A human-readable name for this extension.
   */
  @Override()
  public String getExtensionName()
  {
    return "Internal Operation Attachment SASL Mechanism Handler";
  }



  /**
   * Retrieves a human-readable description for this extension.  Each element
   * of the array that is returned will be considered a separate paragraph in
   * generated documentation.
   *
   * @return  A human-readable description for this extension, or {@code null}
   *          or an empty array if no description should be available.
   */
  @Override()
  public String[] getExtensionDescription()
  {
    return new String[]
    {
      "Implements support for a number of related SASL mechanisms that use " +
           "operation attachments to define the behavior the server should " +
           "exhibit when processing the bind operation.  This is only " +
           "intended to be used internally within the server and should not " +
           "be directly requested by an external client.  It is primarily " +
           "expected to be used in conjunction with a pre-parse bind plugin " +
           "that performs all of the authentication processing itself, but " +
           "then converts the bind request to this mechanism to use the " +
           "information provided in attachments to define the result of the " +
           "operation processing.",

      "The " + SECURE_PASSWORD_BASED_SASL_MECHANISM_NAME + " mechanism " +
           "should be used if the authentication used a password provided by " +
           "the client, and that the password and any other associated " +
           "credentials were provided in a secure manner (that is, in a " +
           "manner that is not vulnerable to eavesdropping, replay, or " +
           "alteration attacks).",

      "The " + NON_SECURE_PASSWORD_BASED_SASL_MECHANISM_NAME + " mechanism " +
           "should be used if the authentication used a password provided by " +
           "the client, and that the password or any other associated " +
           "credentials were provided in a non-secure manner (that is, in a " +
           "manner that may be vulnerable to eavesdropping, replay, or " +
           "alteration attacks).",

      "The " + SECURE_NON_PASSWORD_BASED_SASL_MECHANISM_NAME + " mechanism " +
           "should be used if the authentication did not use a password " +
           "provided by the client, and that any credentials used were " +
           "provided in a secure manner (that is, in a manner that is not " +
           "vulnerable to eavesdropping, replay, or alteration attacks).",

      "The " + NON_SECURE_NON_PASSWORD_BASED_SASL_MECHANISM_NAME +
           " mechanism should be used if the authentication did not use a " +
           "password provided by the client, but that it did use credentials " +
           "that were provided in a non-secure manner (that is, in a manner " +
           "that may be vulnerable to eavesdropping, replay, or alteration " +
           "attacks).",

      "All four SASL mechanisms implemented by this handler implement " +
           "support for the same set of operation attachments.  Supported " +
           "attachments include:",

      "internal-op-sasl-handler-authentication-succeeded -- indicates " +
           "whether the authentication attempt was successful.  This " +
           "attachment is required, and its value must be an instance of " +
           Boolean.class.getName() + '.',

      "internal-op-sasl-handler-diagnostic-message -- a diagnostic message " +
           "that should be included in the bind response to the client.  " +
           "This attachment is optional and may be included regardless of " +
           "whether the authentication attempt succeeded or failed.  If it " +
           "is provided, then its value must be an instance of " +
           CharSequence.class.getName() + '.',

      "internal-op-sasl-handler-matched-dn -- the matched DN value that " +
           "should be included in the bind response to the client to " +
           "indicate that a provided bind DN did not refer to an entry that " +
           "exists in the server, and to provide the DN of its closest " +
           "ancestor that does exist.  This attachment is optional and " +
           "should only be used if the authentication attempt failed.  If it " +
           "is provided, then its value must be an instance of " +
           DN.class.getName() + '.',

      "internal-op-sasl-handler-server-sasl-credentials -- an encoded set " +
           "of server SASL credentials that should be included in the bind " +
           "response to the client.  This attachment is optional and should " +
           "only be set if the original bind request was itself a SASL bind " +
           "request and server SASL credentials are appropriate for that " +
           "request.  If provided, the value of the attachment must be an " +
           "instance of " + ASN1OctetString.class.getName() + '.',

      "internal-op-sasl-handler-response-controls -- a set of controls that " +
           "should be included in the bind response to the client.  This " +
           "attachment is optional, and if it is not set, then the SASL " +
           "mechanism handler will not add any controls to the response " +
           "(although other components of the server may add response " +
           "controls if appropriate for the operation).  If provided, the " +
           "value of the attachment must be an instance of " +
           Control.class.getName() + "[].",

      "internal-op-sasl-handler-bind-dn -- the DN of the user attempting to " +
           "authenticate.  This attachment must be set if the " +
           "authentication is successful, and it will be set as the " +
           "authentication identity for the associated connection (unless " +
           "the bind request also included the retain identity request " +
           "control).  Even if the bind attempt failed, this attachment " +
           "should be set if it is possible to determine the identity of the " +
           "user that was trying to authenticate so that any appropriate " +
           "password policy state updates can be applied to that account.  " +
           "If provided, the value of the attachment must be an instance of " +
           DN.class.getName() + '.',

      "internal-op-sasl-handler-authentication-failure-reason -- a message " +
           "that will not appear in the bind response to the client, but " +
           "will be included in the server's access log to provide " +
           "additional information about the reason that the authentication " +
           "attempt failed.  This attachment is optional and should only be " +
           "used if the authentication attempt failed.  If it is provided, " +
           "then its value must be an instance of " +
           CharSequence.class.getName() + '.',

      "internal-op-sasl-handler-authorization-dn -- the DN of the user that " +
           "is the alternate authorization identity for the bind operation.  " +
           "This should only be set if the bind attempt succeeded and " +
           "requested an alternate authorization identity.  If provided, the " +
           "value of the attachment must be an instance of " +
           DN.class.getName() + '.',

      "internal-op-sasl-handler-password-used -- the password that the " +
           "client provided during the authentication attempt.  This " +
           "attachment is optional and should only be used if the " +
           "authentication attempt was successful and used a password.  If " +
           "provided, the value of the attachment must be an instance of " +
           ASN1OctetString.class.getName() + '.',
    };
  }



  /**
   * Updates the provided argument parser to define any configuration arguments
   * which may be used by this extension.  The argument parser may also be
   * updated to define relationships between arguments (e.g., to specify
   * required, exclusive, or dependent argument sets).
   *
   * @param  parser  The argument parser to be updated with the configuration
   *                 arguments which may be used by this extension.
   */
  @Override()
  public void defineConfigArguments(final ArgumentParser parser)
  {
    // No arguments will be allowed by default.
  }



  /**
   * Initializes this SASL mechanism handler.
   *
   * @param  serverContext  A handle to the server context for the server in
   *                        which this extension is running.
   * @param  config         The general configuration for this SASL mechanism
   *                        handler.
   * @param  parser         The argument parser which has been initialized from
   *                        the configuration for this SASL mechanism handler.
   */
  @Override()
  public void initializeSASLMechanismHandler(
                   final DirectoryServerContext serverContext,
                   final SASLMechanismHandlerConfig config,
                   final ArgumentParser parser)
  {
    if (this.serverContext == null)
    {
      this.serverContext = serverContext;
    }
  }



  /**
   * Indicates whether the configuration represented by the provided argument
   * parser is acceptable for use by this extension.  The parser will have been
   * used to parse any configuration available for this extension, and any
   * automatic validation will have been performed.  This method may be used to
   * perform any more complex validation which cannot be performed automatically
   * by the argument parser.
   *
   * @param  config               The general configuration for this extension.
   * @param  parser               The argument parser that has been used to
   *                              parse the proposed configuration for this
   *                              extension.
   * @param  unacceptableReasons  A list to which messages may be added to
   *                              provide additional information about why the
   *                              provided configuration is not acceptable.
   *
   * @return  {@code true} if the configuration in the provided argument parser
   *          appears to be acceptable, or {@code false} if not.
   */
  @Override()
  public boolean isConfigurationAcceptable(
                      final SASLMechanismHandlerConfig config,
                      final ArgumentParser parser,
                      final List<String> unacceptableReasons)
  {
    if (serverContext == null)
    {
      serverContext = config.getServerContext();
    }

    // No validation is needed.
    return true;
  }



  /**
   * Attempts to apply the configuration from the provided argument parser to
   * this extension.
   *
   * @param  config                The general configuration for this extension.
   * @param  parser                The argument parser that has been used to
   *                               parse the new configuration for this
   *                               extension.
   * @param  adminActionsRequired  A list to which messages may be added to
   *                               provide additional information about any
   *                               additional administrative actions that may
   *                               be required to apply some of the
   *                               configuration changes.
   * @param  messages              A list to which messages may be added to
   *                               provide additional information about the
   *                               processing performed by this method.
   *
   * @return  A result code providing information about the result of applying
   *          the configuration change.  A result of {@code SUCCESS} should be
   *          used to indicate that all processing completed successfully.  Any
   *          other result will indicate that a problem occurred during
   *          processing.
   */
  @Override()
  public ResultCode applyConfiguration(final SASLMechanismHandlerConfig config,
                                       final ArgumentParser parser,
                                       final List<String> adminActionsRequired,
                                       final List<String> messages)
  {
    if (serverContext == null)
    {
      serverContext = config.getServerContext();
    }

    // There is no configuration to apply.
    return ResultCode.SUCCESS;
  }



  /**
   * Performs any cleanup which may be necessary when this SASL mechanism
   * handler is to be taken out of service.
   */
  @Override()
  public void finalizeSASLMechanismHandler()
  {
    // No finalization is needed.
  }



  /**
   * Retrieves a list of the names of the SASL mechanisms supported by this
   * SASL mechanism handler.  This method will be invoked only immediately after
   * the {@link #initializeSASLMechanismHandler} method is called.
   *
   * @return  A list of the names of the SASL mechanisms supported by this SASL
   *          mechanism handler.
   */
  @Override()
  public List<String> getSASLMechanismNames()
  {
    return Collections.unmodifiableList(Arrays.asList(
         SECURE_PASSWORD_BASED_SASL_MECHANISM_NAME,
         NON_SECURE_PASSWORD_BASED_SASL_MECHANISM_NAME,
         SECURE_NON_PASSWORD_BASED_SASL_MECHANISM_NAME,
         NON_SECURE_NON_PASSWORD_BASED_SASL_MECHANISM_NAME));
  }



  /**
   * Indicates whether the SASL authentication process using the specified
   * mechanism may be considered secure (i.e., that a third party able to
   * observe the communication, potentially over an insecure communication
   * channel, would not be able to reproduce the authentication process).
   *
   * @param  mechanism  The name of the mechanism for which to make the
   *                    determination.  This will only be invoked with names of
   *                    mechanisms returned by the
   *                    {@link #getSASLMechanismNames} method.
   *
   * @return  {@code true} if the specified SASL mechanism should be considered
   *          secure, or {@code false} if not.
   */
  @Override()
  public boolean isSecure(final String mechanism)
  {
    switch (mechanism)
    {
      case SECURE_PASSWORD_BASED_SASL_MECHANISM_NAME:
      case SECURE_NON_PASSWORD_BASED_SASL_MECHANISM_NAME:
        // These mechanisms are considered secure.
        return true;

      case NON_SECURE_PASSWORD_BASED_SASL_MECHANISM_NAME:
      case NON_SECURE_NON_PASSWORD_BASED_SASL_MECHANISM_NAME:
        // These mechanisms are considered non-secure.
        return false;

      default:
        // This should never happen.  Throw a RuntimeException to ensure that
        // this is more visible than other types of non-successful operations.
        final String message = getClass().getName() +
             ".isSecure called with an unsupported SASL mechanism of '" +
             mechanism + "'.";
        if (serverContext != null)
        {
          serverContext.logMessage(LogSeverity.SEVERE_WARNING, message);
        }
        throw new RuntimeException(message);
    }
  }



  /**
   * Indicates whether the SASL authentication process using the specified
   * mechanism involves the use of a password stored locally in the server
   * (optionally in combination with other forms of credentials).
   *
   * @param  mechanism  The name of the mechanism for which to make the
   *                    determination.  This will only be invoked with names of
   *                    mechanisms returned by the
   *                    {@link #getSASLMechanismNames} method.
   *
   * @return  {@code true} if the specified SASL mechanism makes use of a local
   *          password, or {@code false} if not.
   */
  @Override()
  public boolean isPasswordBased(final String mechanism)
  {
    switch (mechanism)
    {
      case SECURE_PASSWORD_BASED_SASL_MECHANISM_NAME:
      case NON_SECURE_PASSWORD_BASED_SASL_MECHANISM_NAME:
        // These mechanisms are password-based.
        return true;

      case SECURE_NON_PASSWORD_BASED_SASL_MECHANISM_NAME:
      case NON_SECURE_NON_PASSWORD_BASED_SASL_MECHANISM_NAME:
        // These mechanisms are not password-based.
        return false;

      default:
        // This should never happen.  Throw a RuntimeException to ensure that
        // this is more visible than other types of non-successful operations.
        final String message = getClass().getName() +
             ".isPasswordBased called with an unsupported SASL mechanism " +
             "of '" + mechanism + "'.";
        if (serverContext != null)
        {
          serverContext.logMessage(LogSeverity.SEVERE_WARNING, message);
        }
        throw new RuntimeException(message);
    }
  }



  /**
   * Performs the appropriate processing for the provided SASL bind request.
   *
   * @param  operationContext  The context for the bind operation.
   * @param  bindRequest       The SASL bind request to be processed.
   * @param  resultFactory     A factory object that will be used to construct
   *                           the result to return.
   *
   * @return  An object with information about the result of the SASL bind
   *          processing.
   */
  @Override()
  public SASLBindResult processSASLBind(final OperationContext operationContext,
                             final SASLBindRequest bindRequest,
                             final SASLBindResultFactory resultFactory)
  {
    final String mechanism = bindRequest.getSASLMechanism();

    boolean authenticationSucceeded;
    final Object authenticationSucceededObject = operationContext.getAttachment(
         ATTACHMENT_NAME_AUTHENTICATION_SUCCEEDED);
    if (authenticationSucceededObject == null)
    {
      authenticationSucceeded = false;
      operationContext.appendAdditionalLogMessage("Indicating that the " +
           "authentication was unsuccessful because the operation was " +
           "missing the " + ATTACHMENT_NAME_AUTHENTICATION_SUCCEEDED +
           " attachment required for use with the " + mechanism +
           " mechanism.");
    }
    else if (authenticationSucceededObject instanceof Boolean)
    {
      authenticationSucceeded =
           ((Boolean) authenticationSucceededObject).booleanValue();
    }
    else
    {
      authenticationSucceeded = false;
      operationContext.appendAdditionalLogMessage("Indicating that the " +
           "authentication was unsuccessful because the " +
           ATTACHMENT_NAME_AUTHENTICATION_SUCCEEDED +
           " attachment was an instance of " +
           authenticationSucceededObject.getClass().getName() +
           " instead of the required " + Boolean.class.getName() + '.');
    }


    final String diagnosticMessage;
    final Object diagnosticMessageObject =
         operationContext.getAttachment(ATTACHMENT_NAME_DIAGNOSTIC_MESSAGE);
    if (diagnosticMessageObject == null)
    {
      diagnosticMessage = null;
    }
    else if (diagnosticMessageObject instanceof CharSequence)
    {
      diagnosticMessage = String.valueOf(diagnosticMessageObject);
    }
    else
    {
      diagnosticMessage = null;
      operationContext.appendAdditionalLogMessage("Ignoring the value of the " +
           ATTACHMENT_NAME_DIAGNOSTIC_MESSAGE +
           " attachment because it was an instance of " +
           diagnosticMessageObject.getClass().getName() +
           " instead of the required " + CharSequence.class.getName() + '.');
    }


    final String matchedDN;
    final Object matchedDNObject =
         operationContext.getAttachment(ATTACHMENT_NAME_MATCHED_DN);
    if (matchedDNObject == null)
    {
      matchedDN = null;
    }
    else if (matchedDNObject instanceof DN)
    {
      matchedDN = ((DN) matchedDNObject).toString();
    }
    else
    {
      matchedDN = null;
      operationContext.appendAdditionalLogMessage("Ignoring the value of the " +
           ATTACHMENT_NAME_MATCHED_DN +
           " attachment because it was an instance of " +
           matchedDNObject.getClass().getName() +
           " instead of the required " + DN.class.getName() + '.');
    }


    final ASN1OctetString serverSASLCredentials;
    final Object serverSASLCredentialsObject = operationContext.getAttachment(
         ATTACHMENT_NAME_SERVER_SASL_CREDENTIALS);
    if (serverSASLCredentialsObject == null)
    {
      serverSASLCredentials = null;
    }
    else if (serverSASLCredentialsObject instanceof ASN1OctetString)
    {
      serverSASLCredentials = (ASN1OctetString) serverSASLCredentialsObject;
    }
    else
    {
      serverSASLCredentials = null;
      operationContext.appendAdditionalLogMessage("Ignoring the value of the " +
           ATTACHMENT_NAME_SERVER_SASL_CREDENTIALS +
           " attachment because it was an instance of " +
           serverSASLCredentialsObject.getClass().getName() +
           " instead of the required " + ASN1OctetString.class.getName() + '.');
    }


    final List<Control> responseControls;
    final Object responseControlsObject =
         operationContext.getAttachment(ATTACHMENT_NAME_RESPONSE_CONTROLS);
    if (responseControlsObject == null)
    {
      responseControls = null;
    }
    else if (responseControlsObject instanceof Control[])
    {
      final Control[] responseControlArray = (Control[]) responseControlsObject;
      responseControls =
           Collections.unmodifiableList(Arrays.asList(responseControlArray));
    }
    else
    {
      responseControls = null;
      operationContext.appendAdditionalLogMessage("Ignoring the value of the " +
           ATTACHMENT_NAME_RESPONSE_CONTROLS +
           " attachment because it was an instance of " +
           responseControlsObject.getClass().getName() +
           " instead of the required " + Control.class.getName() + "[].");
    }


    String authenticationFailureReason;
    final Object authenticationFailureReasonObject =
         operationContext.getAttachment(
              ATTACHMENT_NAME_AUTHENTICATION_FAILURE_REASON);
    if (authenticationFailureReasonObject == null)
    {
      authenticationFailureReason = null;
    }
    else if (authenticationFailureReasonObject instanceof CharSequence)
    {
      authenticationFailureReason =
           String.valueOf(authenticationFailureReasonObject);
    }
    else
    {
      authenticationFailureReason = null;
      operationContext.appendAdditionalLogMessage("Ignoring the value of the " +
           ATTACHMENT_NAME_AUTHENTICATION_FAILURE_REASON +
           " attachment because it was an instance of " +
           authenticationFailureReasonObject.getClass().getName() +
           " instead of the required " + CharSequence.class.getName() + '.');
    }


    final String bindDN;
    final Object bindDNObject =
         operationContext.getAttachment(ATTACHMENT_NAME_BIND_DN);
    if (bindDNObject == null)
    {
      if (authenticationSucceeded)
      {
        bindDN = null;
        authenticationSucceeded = false;
        authenticationFailureReason = "The " + mechanism +
             " bind operation did not have the " +
             ATTACHMENT_NAME_BIND_DN + " attachment set, which is required " +
             "for a successful authentication.";
      }
      else
      {
        bindDN = null;
      }
    }
    else if (bindDNObject instanceof DN)
    {
      bindDN = ((DN) bindDNObject).toString();
    }
    else
    {
      bindDN = null;
      if (authenticationSucceeded)
      {
        authenticationSucceeded = false;
        authenticationFailureReason = "The " + ATTACHMENT_NAME_BIND_DN +
             " attachment was set in the " + mechanism +
             " bind operation, but its value was of type " +
             bindDNObject.getClass().getName() + " instead of the required " +
             "type of " + DN.class.getName() + '.';
      }
      else
      {
        operationContext.appendAdditionalLogMessage("Ignoring the value of " +
             "the " + ATTACHMENT_NAME_BIND_DN +
             " attachment because it was an instance of " +
             bindDNObject.getClass().getName() +
             " instead of the required " + DN.class.getName() + '.');
      }
    }


    final String authorizationDN;
    final Object authorizationDNObject =
         operationContext.getAttachment(ATTACHMENT_NAME_AUTHORIZATION_DN);
    if (authorizationDNObject == null)
    {
      authorizationDN = bindDN;
    }
    else if (authorizationDNObject instanceof DN)
    {
      authorizationDN = ((DN) authorizationDNObject).toString();
    }
    else
    {
      authorizationDN = null;
      if (authenticationSucceeded)
      {
        authenticationSucceeded = false;
        authenticationFailureReason = "The " +
             ATTACHMENT_NAME_AUTHORIZATION_DN + " attachment was set in the " +
             mechanism + " bind operation, but its value was of type " +
             bindDNObject.getClass().getName() + " instead of the required " +
             "type of " + DN.class.getName() + '.';
      }
      else
      {
        operationContext.appendAdditionalLogMessage("Ignoring the value of " +
             "the " + ATTACHMENT_NAME_AUTHORIZATION_DN +
             " attachment because it was an instance of " +
             authorizationDNObject.getClass().getName() +
             " instead of the required " + DN.class.getName() + '.');
      }
    }


    final ASN1OctetString passwordUsed;
    final Object passwordUsedObject =
         operationContext.getAttachment(ATTACHMENT_NAME_PASSWORD_USED);
    if (passwordUsedObject == null)
    {
      passwordUsed = null;
    }
    else if (passwordUsedObject instanceof ASN1OctetString)
    {
      passwordUsed = (ASN1OctetString) passwordUsedObject;
    }
    else
    {
      passwordUsed = null;
      operationContext.appendAdditionalLogMessage("Ignoring the value of the " +
           ATTACHMENT_NAME_PASSWORD_USED +
           " attachment because it was an instance of " +
           passwordUsedObject.getClass().getName() +
           " instead of the required " + ASN1OctetString.class.getName() + '.');
    }


    if (authenticationSucceeded)
    {
      return resultFactory.createSuccessResult(bindDN, authorizationDN,
           diagnosticMessage, responseControls, serverSASLCredentials,
           passwordUsed);
    }
    else
    {
      return resultFactory.createFailureResult(authenticationFailureReason,
           diagnosticMessage, matchedDN, responseControls,
           serverSASLCredentials, bindDN);
    }
  }



  /**
   * Indicates whether the specified SASL mechanism may require multiple stages
   * to process.
   *
   * @param  mechanism  The mechanism for which to make the determination.
   *
   * @return  {@code true} if the specified SASL mechanism may require multiple
   *          stages to process, {@code false} if not, or {@code null} if the
   *          answer is not known for the specified mechanism.
   */
  @Override()
  public Boolean isMultiStageMechanism(final String mechanism)
  {
    switch (mechanism)
    {
      case SECURE_PASSWORD_BASED_SASL_MECHANISM_NAME:
      case NON_SECURE_PASSWORD_BASED_SASL_MECHANISM_NAME:
      case SECURE_NON_PASSWORD_BASED_SASL_MECHANISM_NAME:
      case NON_SECURE_NON_PASSWORD_BASED_SASL_MECHANISM_NAME:
        // None of these mechanisms involve multiple stages of authentication
        // processing.
        return false;

      default:
        // This should never happen.  Throw a RuntimeException to ensure that
        // this is more visible than other types of non-successful operations.
        final String message = getClass().getName() +
             ".isMultiStageMechanism called with an unsupported SASL " +
             "mechanism of '" + mechanism + "'.";
        if (serverContext != null)
        {
          serverContext.logMessage(LogSeverity.SEVERE_WARNING, message);
        }
        throw new RuntimeException(message);
    }
  }



  /**
   * Retrieves a map containing examples of configurations that may be used for
   * this extension.  The map key should be a list of sample arguments, and the
   * corresponding value should be a description of the behavior that will be
   * exhibited by the extension when used with that configuration.
   *
   * @return  A map containing examples of configurations that may be used for
   *          this extension.  It may be {@code null} or empty if there should
   *          not be any example argument sets.
   */
  @Override()
  public Map<List<String>,String> getExamplesArgumentSets()
  {
    return Collections.singletonMap(
         Collections.emptyList(),
         "This SASL mechanism handler does not take any arguments.");
  }



  /**
   * Converts the provided simple bind request to an
   * {@code UpdatableSASLBindRequest} object that can be used to cause this SASL
   * mechanism handler to process a successful authentication as the specified
   * user.  All of the appropriate attachments for this SASL mechanism handler
   * will be set on the associated operation.  It will use the following
   * settings:
   * <UL>
   *   <LI>
   *     The authentication attempt will be considered successful.
   *   </LI>
   *   <LI>
   *     There will not be any diagnostic message, matched DN, response
   *     controls, or server SASL credentials.
   *   </LI>
   *   <LI>
   *     The bind DN from the simple bind request will be used as both the
   *     authentication and authorization identity for the SASL bind.
   *   </LI>
   *   <LI>
   *     The password used will be the password from the simple bind request.
   *   </LI>
   *   <LI>
   *     The SASL bind will be considered password-based.
   *   </LI>
   *   <LI>
   *     The SASL bind will be considered secure if and only if the simple bind
   *     request was received over a secure connection.
   *   </LI>
   * </UL>
   *
   * @param  simpleBindRequest  The simple bind request to use to create the
   *                            corresponding SASL bind request.  It must not
   *                            be {@code null}.
   * @param  operationContext   The operation context with which the provided
   *                            simple bind request is associated.  It must not
   *                            be {@code null}.
   *
   * @return  The {@code UpdatableSASLBindRequest} object created from the
   *          provided {@code UpdatableSimpleBindRequest} object.
   *
   * @throws  LDAPException  If a problem is encountered while trying to create
   *                         the SASL bind request.
   */
  public static UpdatableSASLBindRequest convertToSuccessfulSASLBindRequest(
                     final UpdatableSimpleBindRequest simpleBindRequest,
                     final OperationContext operationContext)
         throws LDAPException
  {
    Validator.ensureNotNullWithMessage(simpleBindRequest,
         InternalOperationAttachmentSASLMechanismHandler.class.getName() +
              ".createSuccessfulSASLBindRequest.simpleBindRequest must not " +
              "be null.");
    Validator.ensureNotNullWithMessage(operationContext,
         InternalOperationAttachmentSASLMechanismHandler.class.getName() +
              ".createSuccessfulSASLBindRequest.operationContext must not be " +
              "null.");

    final String diagnosticMessage = null;
    final List<Control> responseControls = Collections.emptyList();

    return convertToSuccessfulSASLBindRequest(simpleBindRequest,
         operationContext, diagnosticMessage, responseControls);
  }



  /**
   * Converts the provided simple bind request to an
   * {@code UpdatableSASLBindRequest} object that can be used to cause this SASL
   * mechanism handler to process a successful authentication as the specified
   * user.  All of the appropriate attachments for this SASL mechanism handler
   * will be set on the associated operation.  It will use the following
   * settings:
   * <UL>
   *   <LI>
   *     The authentication attempt will be considered successful.
   *   </LI>
   *   <LI>
   *     There will not be any matched DN or server SASL credentials.
   *   </LI>
   *   <LI>
   *     The bind DN from the simple bind request will be used as both the
   *     authentication and authorization identity for the SASL bind.
   *   </LI>
   *   <LI>
   *     The password used will be the password from the simple bind request.
   *   </LI>
   *   <LI>
   *     The SASL bind will be considered password-based.
   *   </LI>
   *   <LI>
   *     The SASL bind will be considered secure if and only if the simple bind
   *     request was received over a secure connection.
   *   </LI>
   * </UL>
   *
   * @param  simpleBindRequest  The simple bind request to use to create the
   *                            corresponding SASL bind request.  It must not
   *                            be {@code null}.
   * @param  operationContext   The operation context with which the provided
   *                            simple bind request is associated.  It must not
   *                            be {@code null}.
   * @param  diagnosticMessage  A diagnostic message to include in the response
   *                            to the client.  It may be {@code null} if no
   *                            diagnostic message should be returned.
   * @param  responseControls   A set of controls to include in the response to
   *                            the client.  It may be {@code null} or empty if
   *                            no response controls should be returned.
   *
   * @return  The {@code UpdatableSASLBindRequest} object created from the
   *          provided information.
   *
   * @throws  LDAPException  If a problem is encountered while trying to create
   *                         the SASL bind request.
   */
  public static UpdatableSASLBindRequest convertToSuccessfulSASLBindRequest(
                     final UpdatableSimpleBindRequest simpleBindRequest,
                     final OperationContext operationContext,
                     final String diagnosticMessage,
                     final List<Control> responseControls)
         throws LDAPException
  {
    Validator.ensureNotNullWithMessage(simpleBindRequest,
         InternalOperationAttachmentSASLMechanismHandler.class.getName() +
              ".createSuccessfulSASLBindRequest.simpleBindRequest must not " +
              "be null.");
    Validator.ensureNotNullWithMessage(operationContext,
         InternalOperationAttachmentSASLMechanismHandler.class.getName() +
              ".createSuccessfulSASLBindRequest.operationContext must not be " +
              "null.");

    final ServerContext serverContext = operationContext.getServerContext();

    final boolean isPasswordBased = true;
    final boolean isSecure = operationContext.isSecure();

    final DN authenticationDN;
    try
    {
      authenticationDN = new DN(simpleBindRequest.getDN());
    }
    catch (final LDAPException e)
    {
      serverContext.debugCaught(e);
      throw new LDAPException(ResultCode.INVALID_DN_SYNTAX,
           "Unable to parse the bind DN from the provided simple bind " +
                "request:  " + StaticUtils.getExceptionMessage(e),
           e);
    }

    final DN authorizationDN = authenticationDN;
    final ByteString passwordUsed = simpleBindRequest.getPassword();

    return convertToSuccessfulSASLBindRequest(simpleBindRequest,
         operationContext, isPasswordBased, isSecure, authenticationDN,
         authorizationDN, diagnosticMessage, responseControls, passwordUsed);
  }



  /**
   * Converts the provided simple bind request to an
   * {@code UpdatableSASLBindRequest} object that can be used to cause this SASL
   * mechanism handler to process a successful authentication using the provided
   * information.  All of the appropriate attachments for this SASL mechanism
   * will be set on the associated operation.
   *
   * @param  simpleBindRequest  The simple bind request to use to create the
   *                            corresponding SASL bind request.  It must not
   *                            be {@code null}.
   * @param  operationContext   The operation context with which the provided
   *                            simple bind request is associated.  It must not
   *                            be {@code null}.
   * @param  isPasswordBased    Indicates whether the resulting SASL bind should
   *                            be considered password based.
   * @param  isSecure           Indicates whether the resulting SASL bind should
   *                            be considered secure.
   * @param  authenticationDN   The DN of the authentication identity for the
   *                            resulting SASL bind operation.  It must not be
   *                            {@code null}, but may be {@code DN.NULL_DN} to
   *                            indicate an anonymous authentication identity.
   * @param  authorizationDN    The DN of the authorization identity for the
   *                            resulting SASL bind operation.  It must not be
   *                            {@code null}, but may be {@code DN.NULL_DN} to
   *                            indicate an anonymous authentication identity.
   *                            In most cases, this will be the same as the
   *                            authentication DN, but they may differ if
   *                            operations should be processed under the
   *                            authority of a different user than the
   *                            authentication identity.
   * @param  diagnosticMessage  A diagnostic message to include in the response
   *                            to the client.  It may be {@code null} if no
   *                            diagnostic message should be returned.
   * @param  responseControls   A set of controls to include in the response to
   *                            the client.  It may be {@code null} or empty if
   *                            no response controls should be returned.
   * @param  passwordUsed       The password used to authenticate the client.
   *                            It may be {@code null} if the authentication
   *                            was not password-based, or if the password used
   *                            is not known.
   *
   * @return  The {@code UpdatableSASLBindRequest} object created from the
   *          provided information.
   */
  public static UpdatableSASLBindRequest convertToSuccessfulSASLBindRequest(
                     final UpdatableSimpleBindRequest simpleBindRequest,
                     final OperationContext operationContext,
                     final boolean isPasswordBased, final boolean isSecure,
                     final DN authenticationDN, final DN authorizationDN,
                     final String diagnosticMessage,
                     final List<Control> responseControls,
                     final ByteString passwordUsed)
  {
    Validator.ensureNotNullWithMessage(simpleBindRequest,
         InternalOperationAttachmentSASLMechanismHandler.class.getName() +
              ".createSuccessfulSASLBindRequest.simpleBindRequest must not " +
              "be null.");
    Validator.ensureNotNullWithMessage(operationContext,
         InternalOperationAttachmentSASLMechanismHandler.class.getName() +
              ".createSuccessfulSASLBindRequest.operationContext must not be " +
              "null.");
    Validator.ensureNotNullWithMessage(authenticationDN,
         InternalOperationAttachmentSASLMechanismHandler.class.getName() +
              ".createSuccessfulSASLBindRequest.authenticationDN must not be " +
              "null.");
    Validator.ensureNotNullWithMessage(authorizationDN,
         InternalOperationAttachmentSASLMechanismHandler.class.getName() +
              ".createSuccessfulSASLBindRequest.authorizationDN must not be " +
              "null.");

    final String saslMechanism;
    if (isPasswordBased)
    {
      if (isSecure)
      {
        saslMechanism = SECURE_PASSWORD_BASED_SASL_MECHANISM_NAME;
      }
      else
      {
        saslMechanism = NON_SECURE_PASSWORD_BASED_SASL_MECHANISM_NAME;
      }
    }
    else
    {
      if (isSecure)
      {
        saslMechanism = SECURE_NON_PASSWORD_BASED_SASL_MECHANISM_NAME;
      }
      else
      {
        saslMechanism = NON_SECURE_NON_PASSWORD_BASED_SASL_MECHANISM_NAME;
      }
    }

    operationContext.setAttachment(ATTACHMENT_NAME_AUTHENTICATION_SUCCEEDED,
         Boolean.TRUE);
    operationContext.setAttachment(ATTACHMENT_NAME_BIND_DN, authenticationDN);

    if (! authenticationDN.equals(authorizationDN))
    {
      operationContext.setAttachment(ATTACHMENT_NAME_AUTHORIZATION_DN,
           authorizationDN);
    }

    if (diagnosticMessage != null)
    {
      operationContext.setAttachment(ATTACHMENT_NAME_DIAGNOSTIC_MESSAGE,
           diagnosticMessage);
    }

    if ((responseControls != null) && (! responseControls.isEmpty()))
    {
      final Control[] responseControlArray =
           new Control[responseControls.size()];
      responseControls.toArray(responseControlArray);
      operationContext.setAttachment(ATTACHMENT_NAME_RESPONSE_CONTROLS,
           responseControlArray);
    }

    if (passwordUsed != null)
    {
      operationContext.setAttachment(ATTACHMENT_NAME_PASSWORD_USED,
           passwordUsed);
    }

    return simpleBindRequest.convertToSASLBindRequest(saslMechanism, null);
  }



  /**
   * Converts the provided simple bind request to an
   * {@code UpdatableSASLBindRequest} object that can be used to cause this SASL
   * mechanism handler to process a failed authentication attempt .  All of the
   * appropriate attachments for this SASL mechanism handler will be set on the
   * associated operation.  It will use the following settings:
   * <UL>
   *   <LI>
   *     The authentication attempt will be considered a failure.
   *   </LI>
   *   <LI>
   *     There will not be any diagnostic message, authentication failure
   *     reason, matched DN, response controls, or server SASL credentials.
   *   </LI>
   *   <LI>
   *     The bind DN from the simple bind request will be used as both the
   *     target user DN for the SASL bind.
   *   </LI>
   *   <LI>
   *     The SASL bind will be considered password-based.
   *   </LI>
   *   <LI>
   *     The SASL bind will be considered secure if and only if the simple bind
   *     request was received over a secure connection.
   *   </LI>
   * </UL>
   *
   * @param  simpleBindRequest  The simple bind request to use to create the
   *                            corresponding SASL bind request.  It must not
   *                            be {@code null}.
   * @param  operationContext   The operation context with which the provided
   *                            simple bind request is associated.  It must not
   *                            be {@code null}.
   *
   * @return  The {@code UpdatableSASLBindRequest} object created from the
   *          provided information.
   *
   * @throws  LDAPException  If a problem is encountered while trying to create
   *                         the SASL bind request.
   */
  public static UpdatableSASLBindRequest convertToFailedSASLBindRequest(
                     final UpdatableSimpleBindRequest simpleBindRequest,
                     final OperationContext operationContext)
         throws LDAPException
  {
    Validator.ensureNotNullWithMessage(simpleBindRequest,
         InternalOperationAttachmentSASLMechanismHandler.class.getName() +
              ".createFailedSASLBindRequest.simpleBindRequest must not " +
              "be null.");
    Validator.ensureNotNullWithMessage(operationContext,
         InternalOperationAttachmentSASLMechanismHandler.class.getName() +
              ".createFailedSASLBindRequest.operationContext must not be " +
              "null.");

    final boolean isPasswordBased = true;
    final boolean isSecure = operationContext.isSecure();
    final String diagnosticMessage = null;
    final String authenticationFailureReason = null;
    final DN matchedDN = null;
    final DN targetUserDN = null;
    final List<Control> responseControls = Collections.emptyList();

    return convertToFailedSASLBindRequest(simpleBindRequest, operationContext,
         isPasswordBased, isSecure, diagnosticMessage,
         authenticationFailureReason, matchedDN, targetUserDN,
         responseControls);
  }



  /**
   * Converts the provided simple bind request to an
   * {@code UpdatableSASLBindRequest} object that can be used to cause this SASL
   * mechanism handler to process a failed authentication attempt using the
   * provided information.  All of the appropriate attachments for this SASL
   * mechanism will be set on the associated operation.
   *
   * @param  simpleBindRequest            The simple bind request to use to
   *                                      create the corresponding SASL bind
   *                                      request.  It must not be {@code null}.
   * @param  operationContext             The operation context with which the
   *                                      provided simple bind request is
   *                                      associated.  It must not be
   *                                      {@code null}.
   * @param  isPasswordBased              Indicates whether the resulting SASL
   *                                      bind should be considered password
   *                                      based.
   * @param  isSecure                     Indicates whether the resulting SASL
   *                                      bind should be considered secure.
   * @param  diagnosticMessage            A diagnostic message to include in the
   *                                      response to the client.  It may be
   *                                      {@code null} if no diagnostic message
   *                                      should be returned.
   * @param  authenticationFailureReason  A message that describes the reason
   *                                      for the authentication failure.  This
   *                                      message will not be returned to the
   *                                      client, but will be included in the
   *                                      access log message for the operation
   *                                      so that administrators may better
   *                                      diagnose the failure.  It may be
   *                                      {@code null} if no authentication
   *                                      failure reason is available.
   * @param  matchedDN                    The matched DN to include in the
   *                                      response to the client.  It may be
   *                                      {@code null} if no matched DN should
   *                                      be included.
   * @param  targetUserDN                 The DN of the user that attempted to
   *                                      authenticate.  It may be {@code null}
   *                                      if the target user DN is not known.
   * @param  responseControls             A set of controls to include in the
   *                                      response to the client.  It may be
   *                                      {@code null} or empty if no response
   *                                      controls should be returned.
   *
   * @return  The {@code UpdatableSASLBindRequest} object created from the
   *          provided information.
   */
  public static UpdatableSASLBindRequest convertToFailedSASLBindRequest(
                     final UpdatableSimpleBindRequest simpleBindRequest,
                     final OperationContext operationContext,
                     final boolean isPasswordBased, final boolean isSecure,
                     final String diagnosticMessage,
                     final String authenticationFailureReason,
                     final DN matchedDN, final DN targetUserDN,
                     final List<Control> responseControls)
  {
    Validator.ensureNotNullWithMessage(simpleBindRequest,
         InternalOperationAttachmentSASLMechanismHandler.class.getName() +
              ".createFailedSASLBindRequest.simpleBindRequest must not " +
              "be null.");
    Validator.ensureNotNullWithMessage(operationContext,
         InternalOperationAttachmentSASLMechanismHandler.class.getName() +
              ".createFailedSASLBindRequest.operationContext must not be " +
              "null.");

    final String saslMechanism;
    if (isPasswordBased)
    {
      if (isSecure)
      {
        saslMechanism = SECURE_PASSWORD_BASED_SASL_MECHANISM_NAME;
      }
      else
      {
        saslMechanism = NON_SECURE_PASSWORD_BASED_SASL_MECHANISM_NAME;
      }
    }
    else
    {
      if (isSecure)
      {
        saslMechanism = SECURE_NON_PASSWORD_BASED_SASL_MECHANISM_NAME;
      }
      else
      {
        saslMechanism = NON_SECURE_NON_PASSWORD_BASED_SASL_MECHANISM_NAME;
      }
    }

    operationContext.setAttachment(ATTACHMENT_NAME_AUTHENTICATION_SUCCEEDED,
         Boolean.FALSE);

    if (diagnosticMessage != null)
    {
      operationContext.setAttachment(ATTACHMENT_NAME_DIAGNOSTIC_MESSAGE,
           diagnosticMessage);
    }

    if (authenticationFailureReason != null)
    {
      operationContext.setAttachment(
           ATTACHMENT_NAME_AUTHENTICATION_FAILURE_REASON,
           authenticationFailureReason);
    }

    if (matchedDN != null)
    {
      operationContext.setAttachment(ATTACHMENT_NAME_MATCHED_DN, matchedDN);
    }

    if (targetUserDN != null)
    {
      operationContext.setAttachment(ATTACHMENT_NAME_BIND_DN, targetUserDN);
    }

    if ((responseControls != null) && (! responseControls.isEmpty()))
    {
      final Control[] responseControlArray =
           new Control[responseControls.size()];
      responseControls.toArray(responseControlArray);
      operationContext.setAttachment(ATTACHMENT_NAME_RESPONSE_CONTROLS,
           responseControlArray);
    }

    return simpleBindRequest.convertToSASLBindRequest(saslMechanism, null);
  }
}