OpenLDAP Password Policy account state handling.

[O'Dowd, Josh]

Hi,

Something else with this that is concerning…

These two TRACE snippets represent a successful SSO login followed by a non-successful login where I land back on the login page.

TRACE [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:150] - Profile Action ValidateUsernamePasswordAga
instLDAP: Authentication response [org.ldaptive.auth.AuthenticationResponse at 1328806434::authenticationResultCode=AUTHENTICATION_HANDLER_SUCCESS, lda
pEntry=[dn=uid={normal account id},ou=people,dc=umt,dc=edu[[umid[xxxxxxxxx]]], responseControls=null, messageId=-1], accountState=null, result=true, resultCod
e=SUCCESS, message=null, controls=[[org.ldaptive.control.PasswordPolicyControl at -350057371::criticality=false, timeBeforeExpiration=0, graceAuthNsRem
aining=0, error=null]]]

TRACE [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:150] - Profile Action ValidateUsernamePasswordAgainstLDAP: Authentication response [org.ldaptive.auth.AuthenticationResponse at 203824680::authenticationResultCode=AUTHENTICATION_HANDLER_SUCCESS, ldapEntry=[dn=uid={forced password reset account id},ou=people,dc=umt,dc=edu[]], accountState=[org.ldaptive.auth.ext.PasswordPolicyAccountState at 1145598332::accountWarnings=null, accountErrors=[CHANGE_AFTER_RESET]], result=true, resultCode=SUCCESS, message=null, controls=[[org.ldaptive.control.PasswordPolicyControl at 587665572::criticality=false, timeBeforeExpiration=0, graceAuthNsRemaining=0, error=CHANGE_AFTER_RESET]]]

Notice the ‘umid[xxxxxxxx]’ of the normal login.  That is a return attribute that one of our downstream flows depends on.  So I think the reason I am landing back on the login page is that we are not handling the exception created when authentication is “SUCCESS” but the return attribute is missing, as in the second case where the CHANGE_AFTER_RESET accountError prevents the return attribute(s) from happening.

So that is another problem in itself, I think…  that the return attributes are not fetched when there is an accountError within the account state.

Josh O’Dowd
Software Systems Engineer / Identity Access Management
Central IT, University of Montana


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161212/28c7bef1/attachment.html>