[JENKINS-73812] Adding minimum password length for FIPS compliance

src/main/java/hudson/plugins/active_directory/ActiveDirectoryDomain.java

@@ -32,6 +32,7 @@
 import hudson.util.ListBoxModel;
 import hudson.util.Secret;
 import jenkins.model.Jenkins;
+import jenkins.security.FIPS140;
 import org.acegisecurity.BadCredentialsException;
 import org.apache.commons.lang.StringUtils;
 import org.kohsuke.accmod.Restricted;
@@ -149,6 +150,11 @@
     @DataBoundConstructor
     public ActiveDirectoryDomain(String name, String servers, String site, String bindName, String bindPassword, TlsConfiguration tlsConfiguration) {
         this.name = name;
+        // Gives exception if Password is set lees than 14 chars long in FIPS mode.
+        if(FIPS140.useCompliantAlgorithms() && StringUtils.length(bindPassword) < 14) {
+            throw new IllegalArgumentException(Messages.passwordTooShortFIPS());
+        }
+
         // Append default port if not specified
         servers = fixEmpty(servers);
         if (servers != null) {
@@ -266,6 +272,17 @@
             return model;
         }
 
+        /**
+         * Displays an error message if the provided password is less than 14 characters
+         * while in FIPS mode. This message is triggered when the bindPassword field loses focus.
+         */
+        public FormValidation doCheckBindPassword(@QueryParameter String bindPassword) {
+            if(FIPS140.useCompliantAlgorithms() && StringUtils.length(bindPassword) < 14) {
+                return FormValidation.error(Messages.passwordTooShortFIPS());
+            }
+            return FormValidation.ok();
+        }
+
         @RequirePOST
         public FormValidation doValidateTest(@QueryParameter(fixEmpty = true) String name, @QueryParameter(fixEmpty = true) String servers, @QueryParameter(fixEmpty = true) String site, @QueryParameter(fixEmpty = true) String bindName,
                                              @QueryParameter(fixEmpty = true) String bindPassword, @QueryParameter(fixEmpty = true) TlsConfiguration tlsConfiguration, @QueryParameter GroupLookupStrategy groupLookupStrategy,

src/main/resources/hudson/plugins/active_directory/Messages.properties

@@ -13,4 +13,5 @@ TlsConfiguration.TrustAllCertificates = (Insecure) Trust all Certificates
 TlsConfiguration.JdkTrustStore = JDK TrustStore
 
 TlsConfiguration.AdministrativeMonitor.DisplayName = Active Directory TLS Configuration Monitor
-TlsConfiguration.ErrorMessage = Disabling TLS in FIPS mode is not allowed. Either enable StartTls or Require TLS.
+TlsConfiguration.ErrorMessage = Disabling TLS in FIPS mode is not allowed. Either enable StartTls or Require TLS.
+passwordTooShortFIPS = Password is too short (< 14 characters)

src/test/java/hudson/plugins/active_directory/ActiveDirectoryDomainTest.java

@@ -0,0 +1,66 @@
+package hudson.plugins.active_directory;
+
+import org.junit.ClassRule;
+import org.junit.Test;
+import org.jvnet.hudson.test.FlagRule;
+
+import hudson.util.FormValidation;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertThrows;
+
+public class ActiveDirectoryDomainTest {
+
+
+	private ActiveDirectorySecurityRealm securityRealm;
+	private AbstractActiveDirectoryAuthenticationProvider authenticationProvider;
+
+	@ClassRule
+	public static FlagRule<String> fipsSystemPropertyRule =
+			FlagRule.systemProperty("jenkins.security.FIPS140.COMPLIANCE", "true");
+
+
+	@Test
+	public void testPasswordTooShortInFIPSMode() {
+		// Create an instance of ActiveDirectoryDomain with a short password and assert exception
+		IllegalArgumentException exception = assertThrows(IllegalArgumentException.class, () -> {
+			new ActiveDirectoryDomain("example.com", "server", "site", "bindName", "short", TlsConfiguration.TRUST_ALL_CERTIFICATES);
+		});
+
+		// Verify the exception message
+		assertEquals(Messages.passwordTooShortFIPS(), exception.getMessage());
+	}
+
+	@Test
+	public void testPasswordValidInFIPSMode() {
+		// Create an instance of ActiveDirectoryDomain with a valid password
+		ActiveDirectoryDomain domain = new ActiveDirectoryDomain("example.com", "server", "site", "bindName", "validPassword123", TlsConfiguration.TRUST_ALL_CERTIFICATES);
+
+		// Verify the domain object is created successfully
+		assertEquals("example.com", domain.getName());
+		assertEquals("server:3268", domain.getServers());
+		assertEquals("site", domain.getSite());
+		assertEquals("bindName", domain.getBindName());
+		assertEquals("validPassword123", domain.getBindPassword().getPlainText());
+	}
+
+	@Test
+	public void testDoCheckBindPasswordFIPSModeShortPassword() {
+		// Create an instance of the DescriptorImpl class
+		ActiveDirectoryDomain.DescriptorImpl descriptor = new ActiveDirectoryDomain.DescriptorImpl();
+
+		// Test with a password less than 14 characters
+		FormValidation result = descriptor.doCheckBindPassword("shortPass");
+		assertEquals(FormValidation.error(Messages.passwordTooShortFIPS()).getMessage(), result.getMessage());
+	}
+
+	@Test
+	public void testDoCheckBindPasswordFIPSModeValidPassword() {
+		// Create an instance of the DescriptorImpl class
+		ActiveDirectoryDomain.DescriptorImpl descriptor = new ActiveDirectoryDomain.DescriptorImpl();
+
+		// Test with a password of 14 characters or more
+		FormValidation result = descriptor.doCheckBindPassword("validPassword123");
+		assertEquals(FormValidation.ok().getMessage(), result.getMessage());
+	}
+}