I would advise against directly querying or manipulating the database. It is safer to use the provided java APIs. How are you tracking when they last logged in?
Also, if you are only concerned about stale passwords on system user accounts, then there is an existing mechanism to expire passwords via the “Password Complexity Policies” configured on the system directory service.
The system user password complexity policy feature was added for:
MWS_8.2_SP1_Fix8
MWS_8.0_SP2_Fix15
Or any version of later than MWS 9.0
For example, you could create your own custom jar file that contains a custom java class that implements the
com.webMethods.portal.service.dir.ISystemPasswordComplexityPolicy interface. Specifically, the getPasswordExpirationDuration method would determine how long a password is valid.
For example, something like this:
import java.util.regex.Pattern;
import com.webmethods.portal.service.dir.IDirPrincipal;
import com.webmethods.portal.service.dir.ISystemPasswordComplexityPolicy;
import com.webmethods.rtl.util.Debug;
/**
* Sample implementation of password complexity policy
*/
public class SampleSystemPasswordComplexityPolicy implements
ISystemPasswordComplexityPolicy {
/**
* Check the candidate password to make sure the value satisfies the complexity
* requirements. If the password is not complex enough, this method should throw
* an {@link InvalidPasswordException} with the reason. If no exception is thrown
* the password is valid.
*
* @param candidatePassword the password to check
* @throws InvalidPasswordException if the password is not valid
*/
public void checkPasswordForNewUser(String candidatePassword)
throws InvalidPasswordException {
if (candidatePassword == null || candidatePassword.length() < 6) {
throw new InvalidPasswordException("Your password must contain at least 6 characters");
}
boolean hasUpper = !candidatePassword.toLowerCase().equals(candidatePassword);
boolean hasLower = !candidatePassword.toUpperCase().equals(candidatePassword);
if (!(hasUpper && hasLower)) {
throw new InvalidPasswordException("Your password must contain upper and lower case characters");
}
boolean hasNumberOrSpecialChar = Pattern.matches(".*[\\W\\d]+.*$", candidatePassword);
if (!hasNumberOrSpecialChar) {
throw new InvalidPasswordException("Your password must contain at least one number or special character");
}
}
/**
* Check the candidate password to make sure the value satisfies the complexity
* requirements. If the password is not complex enough, this method should throw
* an {@link InvalidPasswordException} with the reason. If no exception is thrown
* the password is valid.
*
* @param user the user whose password is being checked.
* @param candidatePassword the password to check
* @throws InvalidPasswordException if the password is not valid
*/
public void checkPasswordForExistingUser(IDirPrincipal user,
String candidatePassword) throws InvalidPasswordException {
checkPasswordForNewUser(candidatePassword);
}
/**
* Return how long a password is valid (in milliseconds) before it expires. The user will not be able
* to login after this time duration has expired and the user must be reset by an administrator or
* a custom reset password page.
*
* @param user the user to get the expiration value for.
* @return return -1 for no password expiration, or the duration (in ms)
*/
public long getPasswordExpirationDuration(IDirPrincipal user) {
try {
if ("sysadmin".equals(user.getName())) {
return -1; //don't expire the sysadmin password.
}
} catch (Exception e) {
Debug.warn(e);
}
int oneday = 86400000; //milliseconds in 1 day
return oneday * 35; //35 days
}
/**
* Returns a description of the expected pattern a password must have. This text
* is displayed on the create user and update user pages of the UI.
*
* @return password descriptive text.
*/
public String getPasswordPatternText() {
return "Password must contain at least 6 characters, contain upper and lower case characters and at least one number or special character.";
}
}
Below is how this feature is documented in the latest version:
Password Complexity Policies
A password complexity policy enforces requirements that make user passwords more resistant to brute-force attacks. You can create a Password Complexity Class and add it to My webMethods Server for use with the system directory service. You cannot use this feature for external directory services.
To install a password complexity class for the system directory service
- Stop My webMethods Server.
- Copy your custom jar file that contains your custom password complexity class to the SoftwareAG\MWS\lib directory.
- Create a [your_jar_file_name_without_jar_extension].bnd file in the SoftwareAG\MWS\lib directory whose file content looks like the following:
# attach as fragment to the caf.server bundle
Fragment-Host: com.webmethods.caf.server
#expand (inline) the contents of the jar containing the classes
#into the bundle.
# TODO: make sure this filename matches the name of your jar file
Include-Resource: @jar_file_name.jar
#import any external java packages that are required
Import-Package: *;resolution:=optional
#export the java packages that should be visible to external consumers
Export-Package: *
-nouses: true
- To re-apply the custom JAR file to the My webMethods Server profile with the new information, run this command from the command line: ./mws.[bat|sh] -s default update-osgi-profile
- Restart My webMethods Server.
- To navigate to the correct page, do one of the following:
a) In My webMethods: Navigate > Applications > Administration > My webMethods >Directory Services > List Directory Services.
b) As system administrator: Administration > User Management > Directory Services Administration > List Directory Services.
- Click the system directory service.
- In the Password Complexity Class field, type the name of the Password Complexity Class created in the Composite Application Framework and click Apply.
If you need to update your custom JAR file, do the following:
- Stop My webMethods Server.
- Update or copy the new custom JAR file to the Software AG_directory\MWS\lib directory.
- Run this command from the command line: ./mws.[bat|sh] -s default update-osgi-profile
- Restart My webMethods Server.