FreeIPA - Password Expiration

[Prashant Bapat]

Thanks for the response Scott.

I guess I'm going to completely drop the idea of handing expired passwords
on IdP side using intercept flow. From what I can gather it should be
handled by the LDAP server itself.

I have some patches on FreeIPA which can do this and so far in the testing
it has been working as expected with no changes on IdP side. This should
solve my problem.

In any case, if I may add, this has not been a wasted effort. Now I feel I
have much better handle on the IdP and its inner workings.

Thanks again Scott and Daniel.


On 23 July 2016 at 00:13, Cantor, Scott <cantor.2 at osu.edu> wrote:

> > I want the user to be denied login if the krbPasswordExpiration attribute
> > returned from LDAP is in the past, i.e the password has expired. The user
> > should be informed of this.
>
> That just doesn't make sense. If a password has expired, then your check
> of the password needs to fail. I mean, that is clear, right? You shouldn't
> be "faking" password expiration, that's not the IdP's job. What happens
> with all the other applications you connect to it? They won't do this
> check. This just isn't a workable strategy.
>
> But either way you cannot do this in an interceptor. If you pull the
> attribute back in the authentication response, then you could either do
> something to get the failure reported in the Password flow, or you just
> need to be writing your own login flow.
>
> What might work is some kind of custom AuthenticationResponseHandler thing
> to process the LDAP result and use that to trigger an ExpiredPassword
> event. I don't know if that's possible, Daniel would have to answer that, I
> don't know the ldaptive APIs.
>
> > This works so far. If the password has expired, freeipa-password-expired
> > view is displayed.
>
> Doesn't matter, it's too late. Authentication is done by then, and you are
> not allowed to "undo" authentication in a "post-authentication
> interceptor". That's why it's called post. It runs after, not during.
>
> > Problem is when the user goes to the SP again in a short time and then
> gets
> > redirected to IdP, because of the shib_idp_session cookie, authentication
> > does not take place and
> > "net.shibboleth.idp.authn.context.AuthenticationContext" will be "null"
> and
> > hence I get an exception like below.
>
> The exception is thrown because your code is incorrect, and makes
> assumptions that are not true about how the system works. On top of that,
> look at the message. It says nothing about AuthenticationContext. It says
> there's no LDAP response. And there isn't, because it's doing SSO. The
> previous request completed authentication, saved the result, and it isn't
> going to do it again on the next one.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160725/91d8230f/attachment.html>