authn eDirectory LDAP and grace logins

[cbaker]

That worked!  Alright here's my implementation so if anyone else asks you can
just direct them here lol...
Thanks so much Scott and Daniel!

in *conf/ldap-authn-config.xml*:
    
    
    <bean name="bindSearchAuthenticator"
class="org.ldaptive.auth.Authenticator" 
p:authenticationResponseHandlers-ref="eDirAuthenticationResponseHandler"
p:resolveEntryOnFailure="%{idp.authn.LDAP.resolveEntryOnFailure:false}"
p:entryResolver-ref="searchEntryResolver">
        <constructor-arg index="0" ref="bindSearchDnResolver" />
        <constructor-arg index="1" ref="authHandler" />
    </bean>
    <bean id="bindSearchDnResolver"
class="org.ldaptive.auth.PooledSearchDnResolver"
        p:baseDn="#{'%{idp.authn.LDAP.baseDN:undefined}'.trim()}"
        p:subtreeSearch="%{idp.authn.LDAP.subtreeSearch:false}"
        p:userFilter="#{'%{idp.authn.LDAP.userFilter:undefined}'.trim()}"
        p:connectionFactory-ref="bindSearchPooledConnectionFactory" />
    <bean id="bindSearchPooledConnectionFactory"
class="org.ldaptive.pool.PooledConnectionFactory"
        p:connectionPool-ref="bindSearchConnectionPool" />
    <bean id="bindSearchConnectionPool"
class="org.ldaptive.pool.BlockingConnectionPool" parent="connectionPool"
        p:connectionFactory-ref="bindSearchConnectionFactory"
p:name="search-pool" />
    <bean id="bindSearchConnectionFactory"
class="org.ldaptive.DefaultConnectionFactory"
p:connectionConfig-ref="bindSearchConnectionConfig" />
    <bean id="bindSearchConnectionConfig" parent="connectionConfig"
p:connectionInitializer-ref="bindConnectionInitializer" />
    <bean id="bindConnectionInitializer"
class="org.ldaptive.BindConnectionInitializer"
            p:bindDn="#{'%{idp.authn.LDAP.bindDN:undefined}'.trim()}">
        <property name="bindCredential">
            <bean class="org.ldaptive.Credential">
                <constructor-arg
value="%{idp.authn.LDAP.bindDNCredential:undefined}" />
            </bean>
        </property>
    </bean>
    
    
    <bean id="searchEntryResolver"
class="org.ldaptive.auth.SearchEntryResolver"
        p:connectionFactory-ref="bindSearchPooledConnectionFactory" />

    <bean id="eDirAuthenticationResponseHandler"
class="org.ldaptive.auth.ext.EDirectoryAuthenticationResponseHandler" />
    

And I've set the following in *conf/ldap.properties*
idp.authn.LDAP.subtreeSearch                    = true
idp.authn.LDAP.returnAttributes                 =
cn,passwordExpirationTime,passwordExpirationInterval,loginExpirationTime,loginGraceRemaining,loginDisabled,nspmPasswordPolicyDN
idp.authn.LDAP.resolveEntryOnFailure            =true


and in *messages/authn-messages.properties*
NoGraces = no-graces
no-graces.message = That username has no grace logins remaining.


and finally in *views/login-error.vm*
## Velocity Template for login error message production, included by
login.vm
##
## authenticationErrorContext - context containing error data, if available
##
#if ($authenticationErrorContext &&
$authenticationErrorContext.getClassifiedErrors().size() > 0 &&
$authenticationErrorContext.getClassifiedErrors().iterator().next() !=
"ReselectFlow")
    ## This handles errors that are classified by the message maps in the
authentication config.
    #set ($eventId =
$authenticationErrorContext.getClassifiedErrors().iterator().next())

    ##custom code to change eventKey
    #if ($eventId == "InvalidPassword")
        ##since we got invalidPassword the ldapEntry shoul exist, no need to
check for null
        #set ($entry =
$ldapResponseContext.getAuthenticationResponse().getLdapEntry())
        
        ##If the RHS is a property or method reference that evaluates to
null, it will not be assigned to the LHS.
        ##so I have to init the grace attribute to false and then if the
getAttribute fails and returns null
        ##it won't overwrite the false.
        #set ($graceAttr = false)
        #set ($graceAttr = $entry.getAttribute("loginGraceRemaining"))
        #if ($graceAttr)
            #set ($graces = $graceAttr.getStringValue())
            #if ($graces == "0")
                #set($eventId = "NoGraces")
            #end
        #end
    #end

    #set ($eventKey = $springMacroRequestContext.getMessage("$eventId",
"login"))
    #set ($message =
$springMacroRequestContext.getMessage("${eventKey}.message", "Login Failure:
$eventId"))
#elseif ($authenticationErrorContext &&
$authenticationErrorContext.getExceptions().size() > 0)
    ## This handles login exceptions that are left unclassified.
    #set ($loginException =
$authenticationErrorContext.getExceptions().get(0))
    #if ($loginException.getMessage())
        #set ($message = "Login Failure: $loginException.getMessage()")
    #else
    	#set ($message = $loginException.toString())
    #end
#end

#if ($message)
  <p class="toperror">$encoder.encodeForHTML($message)</p>
#end





--
View this message in context: http://shibboleth.1660669.n2.nabble.com/authn-eDirectory-LDAP-and-grace-logins-tp7626143p7626184.html
Sent from the Shibboleth - Users mailing list archive at Nabble.com.