Idp force changing initial password?

[Kevin P. Foote]

On Tue, 20 Aug 2013, Gene Matthews wrote:

> In our use case, initial users are going to be assigned a default/random password. When they login for the first time, we would like the SSO process to detect it is a first time login (not sure how to do that -- maybe an LDAP attribute) and if so, force a password change. Is this doable with shibboleth-idp and, if so, can someone point me in the right direction?

One idea...

I am not sure about all of LDAP (in general) however, if you are
connecting to M$AD for your LDAP store you can catch the "user must
rest password" sub code that is coming back from the LDAP 49 error.

You can then present something on the login.jsp page link wise ... to
direct users to the correct mechanics / site to initiate a pw change.

I believe this question has been asked before so also troll the archives
for other ideas.

You could perhaps work this reset into a custom LoginHandler but
leveraging the OOB User/Pass handler your better off telling user to go "over 
there" with a link.

I'm not sure what else you can work up but there are a few starters..

HTH

------
thanks
  kevin.foote