OpenLDAP Password Policy account state handling.

[O'Dowd, Josh]

>> You have <logger name="org.springframework.webflow" level="DEBUG"/> in conf/logback.xml ?

Yes.

>> Dropped in an authentication response handler to mimic ppolicy, it always sets CHANGE_AFTER_RESET.
> Edited conf/authn/password-authn-config.xml and added <value>CHANGE_AFTER_RESET</value> to ExpiredPassword.
>
> A successful login put me back to the login page with no messages.
> By default the expired-password subflow shows an error message on the login page, so I inspected login-error.vm.
> login-error.vm only includes code for resolving a message from the AuthenticationErrorContext.
> That's not a surprising assumption, I don't think halting the login process after a successful login was a consideration.
> Adding a block of code to login-error.vm to resolve a message using the AuthenticationWarningContext got me the behavior I > was expecting.
> Which is, the user is dumped back to the login screen with a message that the password is expired.

Interesting…  I have done the same thing with the following code block added to login-error.vm:
#elseif ($authenticationWarningContext && $authenticationWarningContext.getClassifiedWarnings().size() > 0)
    #set ($eventId = $authenticationWarningContext.getClassifiedWarnings().iterator().next())
    #set ($eventKey = $springMacroRequestContext.getMessage("$eventId", "login"))
    #set ($message = $springMacroRequestContext.getMessage("${eventKey}.message", "EventKey = $eventKey, EventId = $eventId"))

I am not getting the same eventId you are, I think…  What I got for a message when I was returned to the login page was:
EventKey = login, EventId = success

The ‘success' eventId actually correlates to the result coming out of the ValidateUsernamePassword state in the authn/Password flow.  In normal authentications, that result is ‘null’.  I know this will make for a long reply, but consider the snippets below showing a normal ValidateUsernamePassword state transition, followed by an account state error resulting in a different state transition.  Notice that ValidateUsernamePassword state exits back into DiplayUsernamePasswordPage state when the result is ’success', which normally should exiting forward into ‘CallSubjectCanonicalization’, when the result is ’null’.

The snippets each begin from the trace entry which includes the ldaptive authenticationResponse details.  Daniel, can you confirm that you are seeing the same location of the CHANGE_AFTER_RESET in your ldaptiveResponse, where the code is an accountStateError?  Thanks.

*************************** Successful authn/Password flow snippet ***************************

2016-12-14 13:56:52,694 - TRACE [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:150] - Profile Action ValidateUsernamePasswordAgainstLDAP: Authentication response [org.l
daptive.auth.AuthenticationResponse at 2000369131::authenticationResultCode=AUTHENTICATION_HANDLER_SUCCESS, ldapEntry=[{USER ATTRIBUTES/VALUES WERE PRESENT BUT REMOVED FOR PUBLIC POSTING}], res
ponseControls=null, messageId=-1], accountState=null, result=true, resultCode=SUCCESS, message=null, controls=[[org.ldaptive.control.PasswordPolicyControl at -350057371::criticality=false, ti
meBeforeExpiration=0, graceAuthNsRemaining=0, error=null]]]
2016-12-14 13:56:52,694 - INFO [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:152] - Profile Action ValidateUsernamePasswordAgainstLDAP: Login by ‘XXXXXXX’ succeeded
2016-12-14 13:56:52,695 - DEBUG [net.shibboleth.idp.authn.AbstractValidationAction:341] - Profile Action ValidateUsernamePasswordAgainstLDAP: Adding custom Principal(s) defined on underlyi
ng flow descriptor
2016-12-14 13:56:52,695 - DEBUG [org.springframework.webflow.execution.ActionExecutor:53] - Finished executing net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP at 5ca6a38e; r
esult = null
2016-12-14 13:56:52,695 - DEBUG [org.springframework.webflow.execution.AnnotatedAction:149] - Clearing action execution attributes map[[empty]]
2016-12-14 13:56:52,695 - DEBUG [org.springframework.webflow.execution.ActionExecutor:53] - Finished executing [EvaluateAction at 3bdb593 expression = ValidateUsernamePassword, resultExpressi
on = [null]]; result = null
2016-12-14 13:56:52,696 - DEBUG [org.springframework.webflow.engine.ActionState:120] - Action execution [1] returned a [null] event: proceeding to the next action in the list
2016-12-14 13:56:52,696 - DEBUG [org.springframework.webflow.execution.ActionExecutor:49] - Executing [EvaluateAction at 7582fa65 expression = PopulateSubjectCanonicalizationContext, resultEx
pression = [null]]
2016-12-14 13:56:52,696 - DEBUG [org.springframework.webflow.execution.AnnotatedAction:142] - Putting action execution attributes map[[empty]]
2016-12-14 13:56:52,696 - DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:448] - Creating instance of bean 'PopulateSubjectCanonicalizationContext'
2016-12-14 13:56:52,697 - DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:251] - Returning cached instance of singleton bean 'shibboleth.PostLoginSubjectCanonic
alizationFlows'
2016-12-14 13:56:52,701 - DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:1678] - Invoking init method  'initialize' on bean with name 'PopulateSubjectCanonical
izationContext'
2016-12-14 13:56:52,701 - DEBUG [org.springframework.beans.factory.support.DefaultListableBeanFactory:484] - Finished creating instance of bean 'PopulateSubjectCanonicalizationContext'
2016-12-14 13:56:52,702 - DEBUG [org.springframework.webflow.execution.ActionExecutor:49] - Executing net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext at e7cf6bf
2016-12-14 13:56:52,702 - DEBUG [net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext:79] - Profile Action PopulateSubjectCanonicalizationContext: Installing 2 canonicaliza
tion flows into SubjectCanonicalizationContext
2016-12-14 13:56:52,702 - DEBUG [org.springframework.webflow.execution.ActionExecutor:53] - Finished executing net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext at e7cf6bf;
 result = null
2016-12-14 13:56:52,702 - DEBUG [org.springframework.webflow.execution.AnnotatedAction:149] - Clearing action execution attributes map[[empty]]
2016-12-14 13:56:52,702 - DEBUG [org.springframework.webflow.execution.ActionExecutor:53] - Finished executing [EvaluateAction at 7582fa65 expression = PopulateSubjectCanonicalizationContext,
 resultExpression = [null]]; result = null
2016-12-14 13:56:52,702 - DEBUG [org.springframework.webflow.engine.ActionState:120] - Action execution [2] returned a [null] event: proceeding to the next action in the list
2016-12-14 13:56:52,702 - DEBUG [org.springframework.webflow.execution.ActionExecutor:49] - Executing [EvaluateAction at 2e8c92e0 expression = 'proceed', resultExpression = [null]]
2016-12-14 13:56:52,702 - DEBUG [org.springframework.webflow.execution.AnnotatedAction:142] - Putting action execution attributes map[[empty]]
2016-12-14 13:56:52,702 - DEBUG [org.springframework.webflow.execution.AnnotatedAction:149] - Clearing action execution attributes map[[empty]]
2016-12-14 13:56:52,703 - DEBUG [org.springframework.webflow.execution.ActionExecutor:53] - Finished executing [EvaluateAction at 2e8c92e0 expression = 'proceed', resultExpression = [null]];
result = proceed
2016-12-14 13:56:52,703 - DEBUG [org.springframework.webflow.engine.Transition:214] - Executing [Transition at 19bb37f1 on = proceed, to = CallSubjectCanonicalization]
2016-12-14 13:56:52,703 - DEBUG [org.springframework.webflow.engine.Transition:222] - Exiting state 'ValidateUsernamePassword'
2016-12-14 13:56:52,703 - DEBUG [org.springframework.webflow.engine.SubflowState:189] - Entering state 'CallSubjectCanonicalization' of flow 'authn/Password'

*************************** End successful authn/Password flow snippet *************************

*************************** Begin CHANGE_AFTER_RESET authn/Password flow snippet ***************

2016-12-14 13:49:35,845 - TRACE [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:150] - Profile Action ValidateUsernamePasswordAgainstLDAP: Authentication response [org.l
daptive.auth.AuthenticationResponse at 1493300197::authenticationResultCode=AUTHENTICATION_HANDLER_SUCCESS, ldapEntry=[USER ATTRIBUTES/VALUES WERE PRESENT BUT REMOVED FOR PUBLIC POSTING], responseControls=null, messageId=-1], accountState=[org.ldaptive.auth.ext.PasswordPolicyAccountState at 1567265980::accountWarnings=null, accountErrors=[CHANGE_AFTER_RESET]], result=true, resultCode=SUCCESS, message=null, controls=[[org.ldaptive.control.PasswordPolicyControl at 817992815::criticality=false, timeBeforeExpiration=0, graceAuthNsRemaining=0, error=CHANGE_AFTER_RESET]]]
2016-12-14 13:49:35,845 - INFO [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:152] - Profile Action ValidateUsernamePasswordAgainstLDAP: Login by ‘XXXXXXX’ succeeded
2016-12-14 13:49:35,845 - DEBUG [net.shibboleth.idp.authn.AbstractValidationAction:341] - Profile Action ValidateUsernamePasswordAgainstLDAP: Adding custom Principal(s) defined on underlying flow descriptor
2016-12-14 13:49:35,845 - DEBUG [org.springframework.webflow.execution.ActionExecutor:53] - Finished executing net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP at 461513a1; result = success
2016-12-14 13:49:35,845 - DEBUG [org.springframework.webflow.execution.AnnotatedAction:149] - Clearing action execution attributes map[[empty]]
2016-12-14 13:49:35,845 - DEBUG [org.springframework.webflow.execution.ActionExecutor:53] - Finished executing [EvaluateAction at 3bdb593 expression = ValidateUsernamePassword, resultExpression = [null]]; result = success
2016-12-14 13:49:35,846 - DEBUG [org.springframework.webflow.engine.Transition:214] - Executing [Transition at 1c57529d on = *, to = DisplayUsernamePasswordPage]
2016-12-14 13:49:35,846 - DEBUG [org.springframework.webflow.engine.Transition:222] - Exiting state 'ValidateUsernamePassword'
2016-12-14 13:49:35,846 - DEBUG [org.springframework.webflow.engine.ViewState:189] - Entering state 'DisplayUsernamePasswordPage' of flow 'authn/Password'

***************************** End faulty flow snippet  *****************************

Again sorry for the length of this reply but this is all pertinent info.
Josh