IdP 3 - Password Expired

[James McCartin]

Currently, when a user logs in with an expired password, they receive the following error message:

The password you entered was incorrect.

I want to configure Shibboleth to return an error message that indicates their password is expired.  I've tried following the instructions here: https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration#LDAPAuthnConfiguration-HandlingaccountstatewithOpenLDAP to implement this functionality, but it still returns the same error.  Attached is my ldap-authn-config.xml file.  Essentially I've added/modified/removed the following:

Added:
<bean id="authenticationResponseHandler" class="org.ldaptive.auth.ext.PasswordPolicyAuthenticationResponseHandler" />
                <bean id="authenticationControl"  class="org.ldaptive.control.PasswordPolicyControl" />

Modified:

                <bean id="authHandler" class="org.ldaptive.auth.PooledBindAuthenticationHandler" p:connectionFactory-ref="bindPooledConnectionFactory" to <bean id="authHandler" class="org.ldaptive.auth.PooledBindAuthenticationHandler" p:connectionFactory-ref="bindPooledConnectionFactory" p:authenticationControls-ref="authenticationControl" />

<bean name="bindSearchAuthenticator" class="org.ldaptive.auth.Authenticator"> to <bean name="bindSearchAuthenticator" class="org.ldaptive.auth.Authenticator" p:authenticationResponseHandlers-ref="authenticationResponseHandler">

Removed:

                <bean id="authenticationResponseHandler" class="org.ldaptive.auth.ext.ActiveDirectoryAuthenticationResponseHandler" />

In my ldap.properties file I have: idp.authn.LDAP.authenticator= bindSearchAuthenticator

Is there something I'm missing?

Thanks,

James

James McCartin
Senior Systems Engineer
Infrastructure - Technology Services
[cid:3336979044_13522879]
Loyola University Maryland
4501 North Charles Street
Baltimore, MD 21210

410-617-2605
jmccartin at loyola.edu<mailto:jmccartin at loyola.edu>

www.loyola.edu<http://www.loyola.edu/>

[facebook]<http://www.facebook.com/LoyolaMaryland>[twitter]<http://www.twitter.com/LoyolaMaryland>[cid:image004.gif at 01CC0FE3.890D8820]<http://www.youtube.com/LoyolaMaryland>
--
Security Alert: Loyola Technology Services will never ask for your password.  Please do not share it with others.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160630/ae728c05/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image001.gif
Type: image/gif
Size: 2147 bytes
Desc: image001.gif
URL: <http://shibboleth.net/pipermail/users/attachments/20160630/ae728c05/attachment-0004.gif>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image002.gif
Type: image/gif
Size: 2462 bytes
Desc: image002.gif
URL: <http://shibboleth.net/pipermail/users/attachments/20160630/ae728c05/attachment-0005.gif>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image003.gif
Type: image/gif
Size: 2514 bytes
Desc: image003.gif
URL: <http://shibboleth.net/pipermail/users/attachments/20160630/ae728c05/attachment-0006.gif>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image004.gif
Type: image/gif
Size: 2518 bytes
Desc: image004.gif
URL: <http://shibboleth.net/pipermail/users/attachments/20160630/ae728c05/attachment-0007.gif>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: ldap-authn-config.xml
Type: application/xml
Size: 8989 bytes
Desc: ldap-authn-config.xml
URL: <http://shibboleth.net/pipermail/users/attachments/20160630/ae728c05/attachment-0001.wsdl>