Password expiring warning with AD

[joller lee]

On Fri, Feb 5, 2016 at 1:31 PM, Daniel Fisher <dfisher at vt.edu> wrote:

>
> The adAuthenticator configuration will map active directory errors[1] by
> default, but not warnings.
>

> You can wire up support for using the pwdLastSet attribute as a warning.
> Use of any other attributes would require a custom
> AuthenticationResponseHandler. The reason this isn't a default config is
> that the attributes you would use to generate warnings (including
> pwdLastSet) require elevated read access, which means you'll need to
> configure an EntryResolver.
>
> --Daniel Fisher
> [1]
> http://ldapwiki.willeke.com/wiki/Common%20Active%20Directory%20Bind%20Errors
>

This is useful, thanks!
By this way, "password must change" can be treated as a warning,
but not "password expiring (in N days)", right?


> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160205/20e9186d/attachment.html>