Password expiring warning with AD

[Daniel Fisher]

On Mon, Feb 15, 2016 at 4:57 AM, joller lee <joller.lee at gmail.com> wrote:

> On Wed, Feb 10, 2016 at 1:38 PM, Daniel Fisher <dfisher at vt.edu> wrote:
>
>>
>> You'll need to edit ldap-authn-config.xml. Update the Acti
>> veDirectoryAuthenticationResponseHandler to include a password age and
>> provide an entry resolver that can resolve the pwdLastSet attribute. I've
>> updated the wiki to include an example:
>>
>>
>> https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration#LDAPAuthnConfiguration-Usinganentryresolvertogeneratepasswordexpirationwarnings
>>
>> Let me know if that works for you.
>>
>
> With this method, an AccountState(accountWarning) with expiration time is
> always returned as the result of ValidateUsernamePasswordAgainstLDAP, and
> the "password expiring" warning view is displayed.
> I guess some customization is needed to determine whether the password is
> really expiring.
> By the way, with the latest version of ldaptive, a warning period can be
> designated, by which no customization is needed.
>

That functionality will be back ported into the next version of the IDP.


>
> PS. I use Samba 4 and non-privileged users can read the pwdLastSet
> attribute. Is an entry resolver still needed in this case?
>

If the user can read their own pwdLastSet attribute, you don't need to wire
in a custom entry resolver. By default authentication attributes are read
by the user. In that case you only need to add pwdLastSet to
idp.authn.LDAP.returnAttributes.

--Daniel Fisher
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160215/1a69cda4/attachment.html>