FreeIPA - Password Expiration

[Cantor, Scott]

> I want the user to be denied login if the krbPasswordExpiration attribute
> returned from LDAP is in the past, i.e the password has expired. The user
> should be informed of this.

That just doesn't make sense. If a password has expired, then your check of the password needs to fail. I mean, that is clear, right? You shouldn't be "faking" password expiration, that's not the IdP's job. What happens with all the other applications you connect to it? They won't do this check. This just isn't a workable strategy.

But either way you cannot do this in an interceptor. If you pull the attribute back in the authentication response, then you could either do something to get the failure reported in the Password flow, or you just need to be writing your own login flow.

What might work is some kind of custom AuthenticationResponseHandler thing to process the LDAP result and use that to trigger an ExpiredPassword event. I don't know if that's possible, Daniel would have to answer that, I don't know the ldaptive APIs.

> This works so far. If the password has expired, freeipa-password-expired
> view is displayed.

Doesn't matter, it's too late. Authentication is done by then, and you are not allowed to "undo" authentication in a "post-authentication interceptor". That's why it's called post. It runs after, not during.

> Problem is when the user goes to the SP again in a short time and then gets
> redirected to IdP, because of the shib_idp_session cookie, authentication
> does not take place and
> "net.shibboleth.idp.authn.context.AuthenticationContext" will be "null" and
> hence I get an exception like below.

The exception is thrown because your code is incorrect, and makes assumptions that are not true about how the system works. On top of that, look at the message. It says nothing about AuthenticationContext. It says there's no LDAP response. And there isn't, because it's doing SSO. The previous request completed authentication, saved the result, and it isn't going to do it again on the next one.

-- Scott