OpenLDAP Password Policy account state handling.

[Daniel Fisher]

On Fri, Dec 9, 2016 at 5:20 PM, O'Dowd, Josh <Josh.O'Dowd at mso.umt.edu>
wrote:

> Hi,
>
> We are trying to take advantage of an option in the OLDAP to force a user
> to change their password on next login.  We have successfully implemented
> this at the Directory but I am having trouble finding the best way to
> handle this at the IdP(v3.3.0).  I have tuned logging to TRACE the
> authentication response, see below:
> TRACE [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:150]
> - Profile Action ValidateUsernamePasswordAgainstLDAP: Authentication
> response [org.ldaptive.auth.AuthenticationResponse at 1130903839::
> authenticationResultCode=AUTHENTICATION_HANDLER_SUCCESS,
> ldapEntry=[dn=uid=xxxxxxx,ou=people,dc=umt,dc=edu[]],
> accountState=[org.ldaptive.auth.ext.PasswordPolicyAccountState@
> 1392004071::accountWarnings=null, accountErrors=[CHANGE_AFTER_RESET]],
> result=true, resultCode=SUCCESS, message=null, controls=[[org.ldaptive.
> control.PasswordPolicyControl at 1346651430::criticality=false,
> timeBeforeExpiration=0, graceAuthNsRemaining=0, error=CHANGE_AFTER_RESET]]]
> Notice the CHANGE_AFTER_RESET coming in as an accountError.


Don't get too hung up on the language, it just mirrors what is in the
RFC[1]. These aren't errors in the strictest sense.


> That being said I have tried mapping the error code into the
> ClassifiedMessageMap in conf/authn/password-authn-config.xml, to an event
> which I have added to the flows/authn/conditions/conditions-flow.xml as a
> transition to the expired-password sub-flow.


Your configuration looks like this?

        <entry key="ExpiredPassword">
            <list>
                <value>PASSWORD_EXPIRED</value>
                <value>CHANGE_AFTER_RESET</value>
            </list>
        </entry>



>   That did not work.  Maybe because there is no exception when the
> authenticationResultCode=AUTHENTICATION_HANDLER_SUCCESS?
>

No. An exception always fires the AUTHN_EXCEPTION event.


> Is there a provided method for the IdP to handle a PPolicy accountError in
> the ldaptive response when the authn result code happens to be ‘success’?
>

Yes. You should see an AuthenticationWarningContext added to the
AuthenticationContext. If you do, it's just a matter of getting the correct
flow to fire.

--Daniel Fisher

[1]
https://tools.ietf.org/html/draft-behera-ldap-password-policy-10#section-6.2
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161212/c51cb134/attachment.html>