OpenLDAP Password Policy account state handling.

[O'Dowd, Josh]

Hi,

We are trying to take advantage of an option in the OLDAP to force a user to change their password on next login.  We have successfully implemented this at the Directory but I am having trouble finding the best way to handle this at the IdP(v3.3.0).  I have tuned logging to TRACE the authentication response, see below:
TRACE [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:150] - Profile Action ValidateUsernamePasswordAgainstLDAP: Authentication response [org.ldaptive.auth.AuthenticationResponse at 1130903839::authenticationResultCode=AUTHENTICATION_HANDLER_SUCCESS, ldapEntry=[dn=uid=xxxxxxx,ou=people,dc=umt,dc=edu[]], accountState=[org.ldaptive.auth.ext.PasswordPolicyAccountState at 1392004071::accountWarnings=null, accountErrors=[CHANGE_AFTER_RESET]], result=true, resultCode=SUCCESS, message=null, controls=[[org.ldaptive.control.PasswordPolicyControl at 1346651430::criticality=false, timeBeforeExpiration=0, graceAuthNsRemaining=0, error=CHANGE_AFTER_RESET]]]
Notice the CHANGE_AFTER_RESET coming in as an accountError.  Ideally, we want to take the user to the same subflow we have set up for PASSWORD_EXPIRED, which has the user enter a new password and then finishes the authentication flow and  redirects the user to the service.

That being said I have tried mapping the error code into the ClassifiedMessageMap in conf/authn/password-authn-config.xml, to an event which I have added to the flows/authn/conditions/conditions-flow.xml as a transition to the expired-password sub-flow.  That did not work.  Maybe because there is no exception when the authenticationResultCode=AUTHENTICATION_HANDLER_SUCCESS?

I then tried using the PPolicy account state handling beans in the conf/authn/ldap-authn-config.xml and added a messaging property to messaging/authn-messages.properties.  That does not seem to be working out either.

Is there a provided method for the IdP to handle a PPolicy accountError in the ldaptive response when the authn result code happens to be ‘success’?

Thanks for your time.

Josh O’Dowd
University of Montana