Password expiring warning with AD

[joller lee]

I'm trying to implement password expiring and password-must-change warning
with IdPv3 and AD. I wonder whether it's possible without using
external-auth or writing code (or modifying the system stuffs).

LDAP tried, seems that AD doesn't support LDAP warning.
I've also tried Kerberos, with no luck either. I guess Oracle's Kerberos
library simply doesn't support account state warning.

I'm considering reading password last-modified-time from AD with LDAP and
call the password-expiring subflow when it's about to expire, but have no
idea how to achieve it. Post-authentication interceptor? Inherit LDAP
subflow?

Any suggestion?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160205/980c0360/attachment.html>