OpenLDAP Password Policy account state handling.

[Daniel Fisher]

On Wed, Dec 14, 2016 at 10:48 AM, O'Dowd, Josh <Josh.O'Dowd at mso.umt.edu>
wrote:

> Thanks Daniel,
>
> I have continued to make small steps towards finding the root of the
> issue, but not there yet…  Per your last reply, I did implement a
> bindSearchEntryResolver with broad privy for fetching attributes, so the
> LDAP Error Code-50 is no longer occurring.  I can see, though, that the
> auth/Password flow is not reaching a ‘proceed’ event after the
> authentication response happens.  It just returns to the login.vm view with
> no messages.  I still cannot see anything in the logs to indicate what is
> causing this.
>
>
I started with vanila v3.3.0
Dropped in an authentication response handler to mimic ppolicy, it always
sets CHANGE_AFTER_RESET.
Edited conf/authn/password-authn-config.xml and
added <value>CHANGE_AFTER_RESET</value> to ExpiredPassword.

A successful login put me back to the login page with no messages.
By default the expired-password subflow shows an error message on the login
page, so I inspected login-error.vm.
login-error.vm only includes code for resolving a message from the
AuthenticationErrorContext.
That's not a surprising assumption, I don't think halting the login process
after a successful login was a consideration.
Adding a block of code to login-error.vm to resolve a message using the
AuthenticationWarningContext got me the behavior I was expecting.
Which is, the user is dumped back to the login screen with a message that
the password is expired.


> I do have the loggers …webflow, …idp, and …ldaptive tuned up to TRACE or
> DEBUG.  So there is a lot there.  I am hoping that I am just overlooking
> something that is there to find.
>

You have <logger name="org.springframework.webflow" level="DEBUG"/> in
conf/logback.xml ?

--Daniel Fisher
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161214/1ae02635/attachment.html>