Password expiring warning with AD

[Daniel Fisher]

On Thu, Feb 4, 2016 at 10:48 PM, joller lee <joller.lee at gmail.com> wrote:

> I'm trying to implement password expiring and password-must-change warning
> with IdPv3 and AD. I wonder whether it's possible without using
> external-auth or writing code (or modifying the system stuffs).
>

The adAuthenticator configuration will map active directory errors[1] by
default, but not warnings.


>
> LDAP tried, seems that AD doesn't support LDAP warning.
>

You can wire up support for using the pwdLastSet attribute as a warning.
Use of any other attributes would require a custom
AuthenticationResponseHandler. The reason this isn't a default config is
that the attributes you would use to generate warnings (including
pwdLastSet) require elevated read access, which means you'll need to
configure an EntryResolver.

--Daniel Fisher

[1]
http://ldapwiki.willeke.com/wiki/Common%20Active%20Directory%20Bind%20Errors
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160205/5f9c91f7/attachment.html>