Class ContextAwarePasswordValidator

java.lang.Object

com.svenruppert.jsentinel.credential.input.ContextAwarePasswordValidator

public final class ContextAwarePasswordValidator
extends Object

Context-aware password validator that wraps the structural PasswordInputValidator with the checks the Konzept §14 mandates: a password must not contain its user's username, the local part of their email, the email domain, or any of the operator-supplied forbidden terms (CWE-521 / CWE-287).

No composition rules

Modern password guidance (NIST SP 800-63B) advises against composition rules ("must contain a symbol", "must contain a number"). This validator therefore does not enforce composition; it relies on the configured PasswordInputPolicy length window plus context-aware rejection of brittle reused tokens. Operators who want strict composition rules layer their own validator on top.

All substring checks are case-insensitive. Comparison uses String.toLowerCase() on copies of the borrowed char[] that the validator zeroes in a finally block (CWE-226).

Constructor Summary

Constructors

Constructor	Description
ContextAwarePasswordValidator()
ContextAwarePasswordValidator(PasswordInputValidator structural)

Method Summary

Modifier and Type	Method	Description
PasswordInputValidationResult	validate(SecretValue secret, PasswordInputPolicy policy, PasswordContext context)	Runs both the structural and context-aware checks.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

ContextAwarePasswordValidator

public ContextAwarePasswordValidator()

ContextAwarePasswordValidator

public ContextAwarePasswordValidator(PasswordInputValidator structural)

Method Details

validate

public PasswordInputValidationResult validate(SecretValue secret,
 PasswordInputPolicy policy,
 PasswordContext context)

Runs both the structural and context-aware checks. The first violation wins; subsequent checks are not consulted.