IdP 3 - Password Expired

[James McCartin]

Does your setup return an accurate error for unknown username or does it just return the same error it would for a bad password? When I switched to adAuthenticator, I was able to receive error messages that reflected expired accounts and disabled accounts, but now I do not get an error for unknown usernames.

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Craig Pluchinsky
Sent: Thursday, June 30, 2016 2:11 PM
To: Shib Users <users at shibboleth.net>
Subject: RE: IdP 3 - Password Expired

We have this working using the following.

In ldap.properties use idp.authn.LDAP.authenticator = adAuthenticator

Then follow the wiki to add the errors 
https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration#LDAPAuthnConfiguration-ActiveDirectoryConfiguration


-------------------------------
Craig Pluchinsky
IT Services
Indiana University of Pennsylvania
724-357-3327


On Thu, 30 Jun 2016, James McCartin wrote:

> 
> Any idea on how to do this with Active Directory? The documentation mentions Active Directory, but I guess it doesn’t apply.  I can
> see the data value in error change based on whether the account is disabled, expired, etc.:
> 
>  
> 
> LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903D0, comment: AcceptSecurityContext error, data 533, v2580
> 
>  
> 
> I’m hoping there is a way to change the error message based on this.
> 
>  
> 
> From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Daniel Fisher
> Sent: Thursday, June 30, 2016 1:14 PM
> To: Shib Users <users at shibboleth.net>
> Subject: Re: IdP 3 - Password Expired
> 
>  
> 
> On Thu, Jun 30, 2016 at 12:14 PM, James McCartin <jmccartin at loyola.edu> wrote:
>
>       I also see the following if I turn on trace for net.shibboleth.idp:
>
>        
>
>       2016-06-30 12:08:39,410 - TRACE [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:137] - Profile Action
>       ValidateUsernamePasswordAgainstLDAP: Authentication response
>       [org.ldaptive.auth.AuthenticationResponse at 1451698118::authenticationResultCode=AUTHENTICATION_HANDLER_FAILURE,
>       ldapEntry=[dn=CN=jmccartin,OU=Loyola,DC=adtest,DC=loyola,DC=edu[]], accountState=null, result=false,
>       resultCode=INVALID_CREDENTIALS, message=javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr:
>       DSID-0C0903D0, comment: AcceptSecurityContext error, data 773, v2580 ], controls=null]
> 
>  
> 
> That appears to be a response from Active Directory, but you've modified your configuration to support an OpenLDAP ppolicy
> implementation.
> 
>  
> 
> --Daniel Fisher
> 
>  
> 
> 
>