authenticator behavior with AD security context errors

[David Bantz]

Thank you.  This is useful generally, but the use case we’re working is sort of the reverse -
they want users to gain access (have authenticated identity asserted) EVEN IF
their AD account is expired or disabled!

David Bantz

> In any LDAP query to AD for a user, always add:
> (!(userAccountControl:1.2.840.113556.1.4.803:=2))
> to test if account  is not disabled. 
> 
> This works from the IDP. 
> 
> See
> http://support.microsoft.com/kb/269181
> http://blogs.msdn.com/b/muaddib/archive/2008/10/08/query-individual-properties-of-the-useraccountcontrol-active-directory-user-property.aspx
> 
> In the login.config  Consider using  com.sun.security.auth.module.Krb5LoginModule
> rather the LDAP for authentication. 
> 
> 
> Even if the x509-login-handler  or kerberos-login-handler  are used which don't require a password,
> in your the data connector make sure the account is not disabled:
> 
>  (&(objectClass=user)(sAMAccountName=$instancePrincipalName.get(0))(!(userAccountControl:1.2.840.113556.1.4.803:=2)))
> 
> (instancePrincipalName  was derived from the username  from user/pasword or kerberos principal name from kerberos-login-handler  without the @realm.)
> 
> 
>> 
>> 
>> 
>> --
>> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> 
> -- 
> 
>  Douglas E. Engert  <DEEngert at gmail.com>
>  
> --
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140310/c0266b19/attachment.html 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 163 bytes
Desc: Message signed with OpenPGP using GPGMail
Url : http://shibboleth.net/pipermail/users/attachments/20140310/c0266b19/attachment.bin