authn eDirectory LDAP and grace logins

[cbaker]

I wrote some test java code using Ldaptive and it seems that if graceLogins
are 0 and password is expired it returns a Failed Authentication error -669
(which comes back as INVALID_CREDENTIALS in Ldaptive) regardless of whether
the password is correct or not.  222 seems to be when the account / login is
expired.  

Either way I can probably event off of the INVALID_CREDENTIALS message and
look in the ldapResponse to check graceLogins.

Here's my test code if anyone is interested (mostly for the next guy that
stumbles across this 3 years from now lol):

  public static void main(String[] args) throws Exception {
    ConnectionConfig connConfig = new
ConnectionConfig("ldaps://ldap.example.edu:636");
    connConfig.setUseStartTLS(false);
    connConfig.setUseSSL(false);
    SearchDnResolver dnResolver = new SearchDnResolver(new
DefaultConnectionFactory(connConfig));
    dnResolver.setBaseDn("o=exampleu");
    dnResolver.setUserFilter("(&(cn={user})(objectClass=person))");
    dnResolver.setSubtreeSearch(true);
    BindAuthenticationHandler authHandler = new
BindAuthenticationHandler(new DefaultConnectionFactory(connConfig));
    Authenticator auth = new Authenticator(dnResolver, authHandler);
    auth.setAuthenticationResponseHandlers(new
EDirectoryAuthenticationResponseHandler());
    AuthenticationResponse response = auth.authenticate(
      new AuthenticationRequest(
        "dilbert", new Credential("******"), new String[]
{"cn","passwordExpirationTime","passwordExpirationInterval",
"clemsonInfoValidDate",
"loginExpirationTime","loginGraceRemaining","loginDisabled",
"nspmPasswordPolicyDN"}));
    if (response.getResult()) {
      System.out.println("response returned positive result");
      // authentication succeeded, check account state
      AccountState state = response.getAccountState();
      // authentication succeeded, only a warning should exist
      AccountState.Warning warning = state.getWarning();
      System.out.println("logins remaining: "+
warning.getLoginsRemaining());
      System.out.println("logins expiration: "+
warning.getExpiration().toString());
      System.out.println("res value is "+response.toString());
    } else {
      System.out.println("response returned negative result");
      System.out.println("res value is "+ response.toString());
      // authentication failed, check account state
      AccountState state = response.getAccountState();
      // authentication failed, only an error should exist
      AccountState.Error error = state.getError();

      System.out.println("error mesg: "+error.getMessage());
      System.out.println("error code: "+error.getCode());
    }
  }



--
View this message in context: http://shibboleth.1660669.n2.nabble.com/authn-eDirectory-LDAP-and-grace-logins-tp7626143p7626164.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.