OpenLDAP Password Policy account state handling.

[Daniel Fisher]

On Wed, Dec 14, 2016 at 6:23 PM, O'Dowd, Josh <Josh.O'Dowd at mso.umt.edu>
wrote:

>
> The snippets each begin from the trace entry which includes the ldaptive
> authenticationResponse details.  Daniel, can you confirm that you are
> seeing the same location of the CHANGE_AFTER_RESET in your
> ldaptiveResponse, where the code is an accountStateError?  Thanks.
>

>From my logs:
TRACE
[net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:150] -
Profile Action ValidateUsernamePasswordAgainstLDAP: Authentication response
[org.ldaptive.auth.AuthenticationResponse at 1871242805::authenticationResultCode=AUTHENTICATION_HANDLER_SUCESS,
ldapEntry=[XXXXXX, responseControls=null, messageId=-1],
accountState=[org.ldaptive.auth.ext.PasswordPolicyAccountState at 1236509355::accountWarnings=null,
accountErrors=[CHANGE_AFTER_RESET]], result=true, resultCode=SUCCESS,
message=null, controls=null]

I faked the account state, you can see the ppolicy control is absent.


> *************************** Begin CHANGE_AFTER_RESET authn/Password flow
> snippet ***************
> 2016-12-14 13:49:35,845 - DEBUG [org.springframework.webflow.execution.ActionExecutor:53]
> - Finished executing net.shibboleth.idp.authn.impl.
> ValidateUsernamePasswordAgainstLDAP at 461513a1; result = success


I'm not sure how you got that result. From my logs:
DEBUG [org.springframework.webflow.execution.ActionExecutor:53] - Finished
executing
net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP at 4a0159d5;
result = ExpiredPassword

Can you do a fresh install and then a recursive diff to confirm you haven't
accidentally changed something.
Thanks.

--Daniel Fisher
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161214/bb9b3fde/attachment.html>