IdP 3 - Password Expired

[Craig Pluchinsky]

I removed the error message mappings for anything related to a username 
that does not exist prior do using adAuthenticator.  We just return 
invalid username/password.

Maybe this will help with AD errors and I'm sure others on this list have 
better info.

http://ldapwiki.willeke.com/wiki/Common%20Active%20Directory%20Bind%20Errors


-------------------------------
Craig Pluchinsky
IT Services
Indiana University of Pennsylvania
724-357-3327


On Wed, 20 Jul 2016, James McCartin wrote:

> Does your setup return an accurate error for unknown username or does it just return the same error it would for a bad password? When I switched to adAuthenticator, I was able to receive error messages that reflected expired accounts and disabled accounts, but now I do not get an error for unknown usernames.
>
> -----Original Message-----
> From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Craig Pluchinsky
> Sent: Thursday, June 30, 2016 2:11 PM
> To: Shib Users <users at shibboleth.net>
> Subject: RE: IdP 3 - Password Expired
>
> We have this working using the following.
>
> In ldap.properties use idp.authn.LDAP.authenticator = adAuthenticator
>
> Then follow the wiki to add the errors
> https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration#LDAPAuthnConfiguration-ActiveDirectoryConfiguration
>
>
> -------------------------------
> Craig Pluchinsky
> IT Services
> Indiana University of Pennsylvania
> 724-357-3327
>
>
> On Thu, 30 Jun 2016, James McCartin wrote:
>
>>
>> Any idea on how to do this with Active Directory? The documentation mentions Active Directory, but I guess it doesn’t apply.  I can
>> see the data value in error change based on whether the account is disabled, expired, etc.:
>>
>>  
>>
>> LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903D0, comment: AcceptSecurityContext error, data 533, v2580
>>
>>  
>>
>> I’m hoping there is a way to change the error message based on this.
>>
>>  
>>
>> From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Daniel Fisher
>> Sent: Thursday, June 30, 2016 1:14 PM
>> To: Shib Users <users at shibboleth.net>
>> Subject: Re: IdP 3 - Password Expired
>>
>>  
>>
>> On Thu, Jun 30, 2016 at 12:14 PM, James McCartin <jmccartin at loyola.edu> wrote:
>>
>>       I also see the following if I turn on trace for net.shibboleth.idp:
>>
>>        
>>
>>       2016-06-30 12:08:39,410 - TRACE [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:137] - Profile Action
>>       ValidateUsernamePasswordAgainstLDAP: Authentication response
>>       [org.ldaptive.auth.AuthenticationResponse at 1451698118::authenticationResultCode=AUTHENTICATION_HANDLER_FAILURE,
>>       ldapEntry=[dn=CN=jmccartin,OU=Loyola,DC=adtest,DC=loyola,DC=edu[]], accountState=null, result=false,
>>       resultCode=INVALID_CREDENTIALS, message=javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr:
>>       DSID-0C0903D0, comment: AcceptSecurityContext error, data 773, v2580 ], controls=null]
>>
>>  
>>
>> That appears to be a response from Active Directory, but you've modified your configuration to support an OpenLDAP ppolicy
>> implementation.
>>
>>  
>>
>> --Daniel Fisher
>>
>>  
>>
>>
>>
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net