Shibboleth - Account Lock Out

[Peter Schober]

* Joshua Brodie <josbrodie at gmail.com> [2015-02-20 18:19]:
> We don't want to switch binds to the Supplier servers - how do you
> resolve this? Is there a way to replicate 'PasswordLockout' or
> 'PasswordRetryCount' among the Consumers?

OpenLDAP can be made to do this, i.e., sync back the password
policy[1] operational attributes from the sync consumer back to the
sync provider, though I don't have a reference handy (as I don't do
any LDAP anymore, these days). It involves the rwm slapd overlay,
IIRC.
-peter

[1] https://tools.ietf.org/html/draft-behera-ldap-password-policy