Password expiring warning with AD

[joller lee]

Thanks for Rich's reminding, I'll share my script here.
I'm not sure whether my implementation is qualified.
Anyway, it works:

In conf/attribute-resolver.xml, assuming an LDAP DataConnector "myLDAP"
exists, add the following:

    <resolver:AttributeDefinition id="passwordExpiration"
xsi:type="ad:Script" sourceAttributeID="pwdLastSet">
        <resolver:Dependency ref="myLDAP" />
        <ad:Script>
          <![CDATA[
            logger =
Java.type("org.slf4j.LoggerFactory").getLogger("net.shibboleth.idp");
            if(typeof pwdLastSet == "undefined" ||
pwdLastSet.getValues().size() < 1) {
                logger.debug("pwdLastSet not found");
                passwordExpiration.addValue("9999/12/31");
            }
            else {
                pwls = pwdLastSet.getValues().get(0);
                FileTimeValueTranscoder =
Java.type("org.ldaptive.ad.io.FileTimeValueTranscoder");
                calendar = new
FileTimeValueTranscoder().decodeStringValue(pwls);
                calendar.add(Java.type("java.util.Calendar").DATE, 180); //
assuming password age of 180 days
                SimpleDateFormat = Java.type("java.text.SimpleDateFormat");
                passwordExpiration.addValue(new
SimpleDateFormat("yyyy/MM/dd").format(calendar.getTime()));
            }
          ]]>
        </ad:Script>
    </resolver:AttributeDefinition>

In conf/ldap.properties, add "pwdLastSet" to the property
"idp.attribute.resolver.LDAP.returnAttributes".

Please note that the pattern used for SimpleDateFormat in my script doesn't
match the default one in expiring-password-intercept-config.xml, so you
have to modify either of them to make sure they match.

I believe it's possible to fulfill my need with a scripted predicate
in expiring-password-intercept-config.xml
solely, but I don't know how to do it presently.

On Mon, Feb 15, 2016 at 10:47 PM, Rich Graves <rgraves at carleton.edu> wrote:

> > I ended up making it with scripted attribute
>
> Share the script either on-list or in the wiki?
> --
> Rich Graves
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160216/b8ab43a6/attachment.html>