authn eDirectory LDAP and grace logins

[Daniel Fisher]

On Tue, Jun 14, 2016 at 3:16 PM, cbaker <craigb at clemson.edu> wrote:

> While this seems to work well most of the time eDirectory / Ldaptive has a
> bad habit of returning invalid-credentials error codes when a user is out
> of
> grace logins.


This implementation was contributed, so if you can improve things please
submit a patch or file an issue[1].


> Is there a way to check the graceLogin attribute when I receive the
> invalid_credentials message from ValidateUsernamePassword?
>
>
According to the novell docs[2], the error code you should get is -222. Is
that the behavior you see?
If so, you should be able to configure your classified message map with
'BAD_PASSWORD' to signal a flow on this event.
Otherwise, like Scott said, you can pull the loginGraceRemaining attribute
out of the LDAPResponseContext in the authentication context.

--Daniel Fisher

[1] https://github.com/vt-middleware/ldaptive
[2] http://support.novell.com/docs/Tids/Solutions/10067240.html
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160614/35beb9a0/attachment.html>