authn eDirectory LDAP and grace logins

[cbaker]

I've gotten password-authn working using ldap and configuring the
bindSearchAuthenticator to use ldaptives eDirectory
AuthenticationResponseHandler 

    <bean name="bindSearchAuthenticator"
class="org.ldaptive.auth.Authenticator" 
p:authenticationResponseHandlers-ref="eDirAuthenticationResponseHandler"
p:resolveEntryOnFailure="%{idp.authn.LDAP.resolveEntryOnFailure:false}">
        <constructor-arg index="0" ref="bindSearchDnResolver" />
        <constructor-arg index="1" ref="authHandler" />
    </bean>

...

    <bean id="eDirAuthenticationResponseHandler"
class="org.ldaptive.auth.ext.EDirectoryAuthenticationResponseHandler" />


While this seems to work well most of the time eDirectory / Ldaptive has a
bad habit of returning invalid-credentials error codes when a user is out of
grace logins.  In php, for example, upon receiving that error code I have
had to look up the user and check their graceLogins so that I can display an
error message saying "Out of grace logins" instead of "invalid credentials".  

Is there a way to check the graceLogin attribute when I receive the
invalid_credentials message from ValidateUsernamePassword?

Thanks for always being there shib community :)



--
View this message in context: http://shibboleth.1660669.n2.nabble.com/authn-eDirectory-LDAP-and-grace-logins-tp7626143.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.