OpenLDAP Password Policy account state handling.

[O'Dowd, Josh]

Honestly,  I am not requesting any resolution on this.  I just wanted to bring what I was finding to your attention and give you the opportunity to evaluate it’s importance.

For our part, I am probably going to turn off that option on our LDAP and, as we discussed earlier, just go with a password reset flag attribute that I can check with MFA logic.  Originally we weren’t looking for login page messaging for this anyway.  It is our policy to allow the user to proceed to the service, even if the account password expired, granted they successfully change their password with a change form flow, which writes their new password and then proceeds to a manual SubjectCanonicalization process.  We do not make expired pwd authentications re-authenticate after they have set a new password.

I appreciate you fellows taking the time today to dive in on this.

Josh


> On Dec 14, 2016, at 4:50 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> 
> On 12/14/16, 6:47 PM, "users on behalf of O'Dowd, Josh" <users-bounces at shibboleth.net on behalf of Josh.O'Dowd at mso.umt.edu> wrote:
> 
>>   In addition, to my initial reply…   This only occurs for the authentication of the user with the accountStateError in the
>> ldaptive authn response.  All other authentications, have been messaging normally, if needed.
> 
> Yes. I assume the LDAP action must be doing this without us being aware it was doing it. There's no risk, as I said, it may think it's intending to say "success" but that's just being treated as any other failure, as opposed to it doing the opposite. A bug probably, but just annoyance.
> 
> -- Scott
> 
> 
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net