OpenLDAP Password Policy account state handling.

[O'Dowd, Josh]

OK, whew…

I found an added entry in our ClassifiedMessageMap that I honestly can’t explain:


        <entry key="success">
            <list>
                <value>SUCCESS</value>
            </list>
        </entry>

When I comment this out, the CHANGE_AFTER_RESET is now mapping as expected.

Sorry guys…  I went back in the file history an it has been there since it was first added to the repo, about 18 months ago.  I should have commented why I added it because now I can’t remember why.

Anyway, again, sorry for the misstep.

Thanks again for your time in helping me figure this out.

Josh

On Dec 14, 2016, at 7:02 PM, Daniel Fisher <dfisher at vt.edu<mailto:dfisher at vt.edu>> wrote:

On Wed, Dec 14, 2016 at 6:23 PM, O'Dowd, Josh <Josh.O'Dowd at mso.umt.edu<mailto:Josh.O'Dowd at mso.umt.edu>> wrote:

The snippets each begin from the trace entry which includes the ldaptive authenticationResponse details.  Daniel, can you confirm that you are seeing the same location of the CHANGE_AFTER_RESET in your ldaptiveResponse, where the code is an accountStateError?  Thanks.

From my logs:
TRACE [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:150] - Profile Action ValidateUsernamePasswordAgainstLDAP: Authentication response [org.ldaptive.auth.AuthenticationResponse at 1871242805::authenticationResultCode=AUTHENTICATION_HANDLER_SUCESS, ldapEntry=[XXXXXX, responseControls=null, messageId=-1], accountState=[org.ldaptive.auth.ext.PasswordPolicyAccountState at 1236509355::accountWarnings=null, accountErrors=[CHANGE_AFTER_RESET]], result=true, resultCode=SUCCESS, message=null, controls=null]

I faked the account state, you can see the ppolicy control is absent.


*************************** Begin CHANGE_AFTER_RESET authn/Password flow snippet ***************
2016-12-14 13:49:35,845 - DEBUG [org.springframework.webflow.execution.ActionExecutor:53] - Finished executing net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP at 461513a1; result = success

I'm not sure how you got that result. From my logs:
DEBUG [org.springframework.webflow.execution.ActionExecutor:53] - Finished executing net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP at 4a0159d5; result = ExpiredPassword

Can you do a fresh install and then a recursive diff to confirm you haven't accidentally changed something.
Thanks.

--Daniel Fisher

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>