From c1bc628e1d27bd6c7efc1ab3d2f68161e8c0e2de Mon Sep 17 00:00:00 2001
From: Simey Lameze <simey@moodle.com>
Date: Wed, 10 Feb 2016 13:30:51 +0800
Subject: [PATCH] MDL-52387 auth_ldap: add support for fine grained password

Contributed by Matthew Johnson.
---
 auth/ldap/auth.php | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/auth/ldap/auth.php b/auth/ldap/auth.php
index 9d3a4ad9702..e099e6bb54b 100644
--- a/auth/ldap/auth.php
+++ b/auth/ldap/auth.php
@@ -2081,7 +2081,21 @@ class auth_plugin_ldap extends auth_plugin_base {
         $entry = ldap_get_entries_moodle($ldapconn, $sr);
         $info = array_change_key_case($entry[0], CASE_LOWER);
         $maxpwdage = $info['maxpwdage'][0];
+        if ($sr = ldap_read($ldapconn, $user_dn, '(objectClass=*)', array('msDS-ResultantPSO', 'msDS-MaximumPasswordAge'))) {
+            if ($entry = ldap_get_entries_moodle($ldapconn, $sr)) {
+                $info = array_change_key_case($entry[0], CASE_LOWER);
+                $userpso = $info['msds-resultantpso'][0];
 
+                // If a PSO exists, FGPP is being utilized.
+                // Grab the new maxpwdage from the msDS-MaximumPasswordAge attribute of the PSO.
+                if (!empty($userpso)) {
+                    if ($entry = ldap_get_entries_moodle($ldapconn, $sr)) {
+                        $info = array_change_key_case($entry[0], CASE_LOWER);
+                        $maxpwdage = $info['msds-maximumpasswordage'][0];
+                    }
+                }
+            }
+        }
         // ----------------------------------------------------------------
         // MSDN says that "pwdLastSet contains the number of 100 nanosecond
         // intervals since January 1, 1601 (UTC), stored in a 64 bit integer".