authn eDirectory LDAP and grace logins

[cbaker]

Daniel Fisher-2 wrote
> On Tue, Jun 14, 2016 at 4:38 PM, Cantor, Scott <

> cantor.2@

> > wrote:
> 
> Not by default, but you can set idp.authn.LDAP.resolveEntryOnFailure=true.
> That will attempt to get the attributes on the same connection that the
> bind failed on.
> If ACLs prevent that from working, a custom entry resolver can be wired
> up.
> 
> --Daniel Fisher

I've set resolveEntryOnFailure to true and I'm still not seeing grace
logins.  When it tries on the same connection, is it using the
BindAuthentication connection or the BindSearchDNResolver connection?  I
know that the credentials that the BindSearchDNResolver can read
graceLogins, but the user that's trying to authenticate can't.  


I toString'd the entire LDAPResponseContext and get this with
resolveEntryOnFailure=false
LDAPResponseContext{authenticationResponse=[org.ldaptive.auth.AuthenticationResponse at 1188680410::authenticationResultCode=AUTHENTICATION_HANDLER_FAILURE,
ldapEntry=[dn=cn=dilbert,ou=d,ou=MISC,o=CLEMSONU[]],
accountState=[org.ldaptive.auth.ext.EDirectoryAccountState at 658655368::accountWarnings=null,
accountErrors=[BAD_PASSWORD]], result=false, resultCode=INVALID_CREDENTIALS,
message=javax.naming.AuthenticationException: [LDAP: error code 49 - NDS
error: bad password (-222)], controls=null]}

and this when it's true
LDAPResponseContext{authenticationResponse=[org.ldaptive.auth.AuthenticationResponse at 86987694::authenticationResultCode=AUTHENTICATION_HANDLER_FAILURE,
ldapEntry=[dn=cn=dilbert,ou=d,ou=MISC,o=CLEMSONU[], responseControls=null,
messageId=-1],
accountState=[org.ldaptive.auth.ext.EDirectoryAccountState at 966960201::accountWarnings=null,
accountErrors=[BAD_PASSWORD]], result=false, resultCode=INVALID_CREDENTIALS,
message=javax.naming.AuthenticationException: [LDAP: error code 49 - NDS
error: bad password (-222)], controls=null]}

So the ldapEntry definitely doesn't contain the grace logins.  How would I
go about making a custom entry resolver, any examples or can you point me to
a place in the idp source to go read even?



--
View this message in context: http://shibboleth.1660669.n2.nabble.com/authn-eDirectory-LDAP-and-grace-logins-tp7626143p7626178.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.