Password expiring warning with AD

[joller lee]

On Wed, Feb 10, 2016 at 1:38 PM, Daniel Fisher <dfisher at vt.edu> wrote:

>
> You'll need to edit ldap-authn-config.xml. Update the Acti
> veDirectoryAuthenticationResponseHandler to include a password age and
> provide an entry resolver that can resolve the pwdLastSet attribute. I've
> updated the wiki to include an example:
>
>
> https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration#LDAPAuthnConfiguration-Usinganentryresolvertogeneratepasswordexpirationwarnings
>
> Let me know if that works for you.
>

With this method, an AccountState(accountWarning) with expiration time is
always returned as the result of ValidateUsernamePasswordAgainstLDAP, and
the "password expiring" warning view is displayed.
I guess some customization is needed to determine whether the password is
really expiring.
By the way, with the latest version of ldaptive, a warning period can be
designated, by which no customization is needed.

PS. I use Samba 4 and non-privileged users can read the pwdLastSet
attribute. Is an entry resolver still needed in this case?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160215/07bc307e/attachment.html>