IdP 3 - Password Expired
James McCartin
jmccartin at loyola.edu
Thu Jun 30 11:55:51 EDT 2016
Here is what I see in the log:
2016-06-30 11:34:58,519 - DEBUG [org.ldaptive.auth.PooledSearchDnResolver:244] - resolve user=jmccartin
2016-06-30 11:34:58,519 - DEBUG [org.ldaptive.auth.PooledSearchDnResolver:310] - searching for DN using userFilter
2016-06-30 11:34:58,519 - DEBUG [org.ldaptive.SearchOperation:138] - execute request=[org.ldaptive.SearchRequest at 1933436586::baseDn=OU=Loyola, DC=adtest, DC=loyola, DC=edu, searchFilter=[org.ldaptive.SearchFilter at -258484773::filter=(sAMAccountName={user}), parameters={user=jmccartin}], returnAttributes=[1.1], searchScope=SUBTREE, timeLimit=0, sizeLimit=0, derefAliases=null, typesOnly=false, binaryAttributes=null, sortBehavior=UNORDERED, searchEntryHandlers=null, searchReferenceHandlers=null, controls=null, followReferrals=false, intermediateResponseHandlers=null] with connection=[org.ldaptive.DefaultConnectionFactory$DefaultConnection at 93979960::config=[org.ldaptive.ConnectionConfig at 491121371::ldapUrl=ldaps://adldaptest.loyola.edu:636, connectTimeout=3000, responseTimeout=-1, sslConfig=[org.ldaptive.ssl.SslConfig at 2067924454::credentialConfig=net.shibboleth.idp.authn.impl.X509ResourceCredentialConfig at 7e9c68c1, trustManagers=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=null], useSSL=true, useStartTLS=false, connectionInitializer=[org.ldaptive.BindConnectionInitializer at 1268947166::bindDn=cn=shibldap,ou=Service Accounts,dc=adtest,dc=loyola,dc=edu, bindSaslConfig=null, bindControls=null]], providerConnectionFactory=[org.ldaptive.provider.jndi.JndiConnectionFactory at 917795383::metadata=[ldapUrl=ldaps://adldaptest.loyola.edu:636, count=1], environment={java.naming.ldap.factory.socket=org.ldaptive.ssl.ThreadLocalTLSSocketFactory, com.sun.jndi.ldap.connect.timeout=3000, java.naming.ldap.version=3, java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory, java.naming.security.protocol=ssl}, providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig at 1532745055::operationExceptionResultCodes=[PROTOCOL_ERROR, SERVER_DOWN], properties={}, connectionStrategy=org.ldaptive.provider.ConnectionStrategies$DefaultConnectionStrategy at e5ab167, controlProcessor=org.ldaptive.provider.ControlProcessor at 7dd672d2, environment=null, tracePackets=null, removeDnUrls=true, searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocketFactory=null, hostnameVerifier=null]], providerConnection=org.ldaptive.provider.jndi.JndiConnection at 518d13d7]
2016-06-30 11:34:58,566 - DEBUG [org.ldaptive.SearchOperation:168] - execute response=[org.ldaptive.Response at 1932105882::result=[org.ldaptive.SearchResult at 955637484::entries=[[dn=CN=jmccartin,OU=Loyola,DC=adtest,DC=loyola,DC=edu[], responseControls=null, messageId=-1]], references=[]], resultCode=SUCCESS, message=null, matchedDn=null, responseControls=null, referralURLs=null, messageId=-1] for request=[org.ldaptive.SearchRequest at 1933436586::baseDn=OU=Loyola, DC=adtest, DC=loyola, DC=edu, searchFilter=[org.ldaptive.SearchFilter at -258484773::filter=(sAMAccountName={user}), parameters={user=jmccartin}], returnAttributes=[1.1], searchScope=SUBTREE, timeLimit=0, sizeLimit=0, derefAliases=null, typesOnly=false, binaryAttributes=null, sortBehavior=UNORDERED, searchEntryHandlers=null, searchReferenceHandlers=null, controls=null, followReferrals=false, intermediateResponseHandlers=null] with connection=[org.ldaptive.DefaultConnectionFactory$DefaultConnection at 93979960::config=[org.ldaptive.ConnectionConfig at 491121371::ldapUrl=ldaps://adldaptest.loyola.edu:636, connectTimeout=3000, responseTimeout=-1, sslConfig=[org.ldaptive.ssl.SslConfig at 2067924454::credentialConfig=net.shibboleth.idp.authn.impl.X509ResourceCredentialConfig at 7e9c68c1, trustManagers=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=null], useSSL=true, useStartTLS=false, connectionInitializer=[org.ldaptive.BindConnectionInitializer at 1268947166::bindDn=cn=shibldap,ou=Service Accounts,dc=adtest,dc=loyola,dc=edu, bindSaslConfig=null, bindControls=null]], providerConnectionFactory=[org.ldaptive.provider.jndi.JndiConnectionFactory at 917795383::metadata=[ldapUrl=ldaps://adldaptest.loyola.edu:636, count=1], environment={java.naming.ldap.factory.socket=org.ldaptive.ssl.ThreadLocalTLSSocketFactory, com.sun.jndi.ldap.connect.timeout=3000, java.naming.ldap.version=3, java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory, java.naming.security.protocol=ssl}, providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig at 1532745055::operationExceptionResultCodes=[PROTOCOL_ERROR, SERVER_DOWN], properties={}, connectionStrategy=org.ldaptive.provider.ConnectionStrategies$DefaultConnectionStrategy at e5ab167, controlProcessor=org.ldaptive.provider.ControlProcessor at 7dd672d2, environment=null, tracePackets=null, removeDnUrls=true, searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocketFactory=null, hostnameVerifier=null]], providerConnection=org.ldaptive.provider.jndi.JndiConnection at 518d13d7]
2016-06-30 11:34:58,581 - DEBUG [org.ldaptive.auth.PooledSearchDnResolver:279] - resolved dn=CN=jmccartin,OU=Loyola,DC=adtest,DC=loyola,DC=edu for user=jmccartin
2016-06-30 11:34:58,581 - DEBUG [org.ldaptive.auth.Authenticator:236] - authenticate dn=CN=jmccartin,OU=Loyola,DC=adtest,DC=loyola,DC=edu with request=[org.ldaptive.auth.AuthenticationRequest at 750203460::user=jmccartin, retAttrs=[cn, businessCategory, mail]]
2016-06-30 11:34:58,581 - DEBUG [org.ldaptive.auth.PooledBindAuthenticationHandler:67] - authenticate criteria=[org.ldaptive.auth.AuthenticationCriteria at 409246976::dn=CN=jmccartin,OU=Loyola,DC=adtest,DC=loyola,DC=edu, authenticationRequest=[org.ldaptive.auth.AuthenticationRequest at 750203460::user=jmccartin, retAttrs=[cn, businessCategory, mail]]]
2016-06-30 11:34:58,581 - DEBUG [org.ldaptive.BindOperation:138] - execute request=[org.ldaptive.BindRequest at 360735737::bindDn=CN=jmccartin,OU=Loyola,DC=adtest,DC=loyola,DC=edu, saslConfig=null, controls=[[org.ldaptive.control.PasswordPolicyControl at -350057371::criticality=false, timeBeforeExpiration=0, graceAuthNsRemaining=0, error=null]]] with connection=[org.ldaptive.DefaultConnectionFactory$DefaultConnection at 541784577::config=[org.ldaptive.ConnectionConfig at 1239540386::ldapUrl=ldaps://adldaptest.loyola.edu:636, connectTimeout=3000, responseTimeout=-1, sslConfig=[org.ldaptive.ssl.SslConfig at 2067924454::credentialConfig=net.shibboleth.idp.authn.impl.X509ResourceCredentialConfig at 7e9c68c1, trustManagers=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=null], useSSL=true, useStartTLS=false, connectionInitializer=null], providerConnectionFactory=[org.ldaptive.provider.jndi.JndiConnectionFactory at 718455963::metadata=[ldapUrl=ldaps://adldaptest.loyola.edu:636, count=1], environment={java.naming.ldap.factory.socket=org.ldaptive.ssl.ThreadLocalTLSSocketFactory, com.sun.jndi.ldap.connect.timeout=3000, java.naming.ldap.version=3, java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory, java.naming.security.protocol=ssl}, providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig at 1063446167::operationExceptionResultCodes=[PROTOCOL_ERROR, SERVER_DOWN], properties={}, connectionStrategy=org.ldaptive.provider.ConnectionStrategies$DefaultConnectionStrategy at e5ab167, controlProcessor=org.ldaptive.provider.ControlProcessor at 352f0e6, environment=null, tracePackets=null, removeDnUrls=true, searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocketFactory=null, hostnameVerifier=null]], providerConnection=org.ldaptive.provider.jndi.JndiConnection at 15dbd4de]
2016-06-30 11:34:58,597 - DEBUG [org.ldaptive.auth.PooledBindAuthenticationHandler:85] - authenticate response=[org.ldaptive.auth.AuthenticationHandlerResponse at 1776347806::connection=[org.ldaptive.DefaultConnectionFactory$DefaultConnection at 541784577::config=[org.ldaptive.ConnectionConfig at 1239540386::ldapUrl=ldaps://adldaptest.loyola.edu:636, connectTimeout=3000, responseTimeout=-1, sslConfig=[org.ldaptive.ssl.SslConfig at 2067924454::credentialConfig=net.shibboleth.idp.authn.impl.X509ResourceCredentialConfig at 7e9c68c1, trustManagers=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=null], useSSL=true, useStartTLS=false, connectionInitializer=null], providerConnectionFactory=[org.ldaptive.provider.jndi.JndiConnectionFactory at 718455963::metadata=[ldapUrl=ldaps://adldaptest.loyola.edu:636, count=1], environment={java.naming.ldap.factory.socket=org.ldaptive.ssl.ThreadLocalTLSSocketFactory, com.sun.jndi.ldap.connect.timeout=3000, java.naming.ldap.version=3, java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory, java.naming.security.protocol=ssl}, providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig at 1063446167::operationExceptionResultCodes=[PROTOCOL_ERROR, SERVER_DOWN], properties={}, connectionStrategy=org.ldaptive.provider.ConnectionStrategies$DefaultConnectionStrategy at e5ab167, controlProcessor=org.ldaptive.provider.ControlProcessor at 352f0e6, environment=null, tracePackets=null, removeDnUrls=true, searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocketFactory=null, hostnameVerifier=null]], providerConnection=org.ldaptive.provider.jndi.JndiConnection at 15dbd4de], result=false, resultCode=INVALID_CREDENTIALS, message=javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903D0, comment: AcceptSecurityContext error, data 773, v2580 ], controls=null] for criteria=[org.ldaptive.auth.AuthenticationCriteria at 409246976::dn=CN=jmccartin,OU=Loyola,DC=adtest,DC=loyola,DC=edu, authenticationRequest=[org.ldaptive.auth.AuthenticationRequest at 750203460::user=jmccartin, retAttrs=[cn, businessCategory, mail]]]
2016-06-30 11:34:58,597 - INFO [org.ldaptive.auth.Authenticator:259] - Authentication failed for dn: CN=jmccartin,OU=Loyola,DC=adtest,DC=loyola,DC=edu
2016-06-30 11:34:58,597 - DEBUG [org.ldaptive.auth.Authenticator:284] - authenticate response=[org.ldaptive.auth.AuthenticationHandlerResponse at 1776347806::connection=[org.ldaptive.DefaultConnectionFactory$DefaultConnection at 541784577::config=[org.ldaptive.ConnectionConfig at 1239540386::ldapUrl=ldaps://adldaptest.loyola.edu:636, connectTimeout=3000, responseTimeout=-1, sslConfig=[org.ldaptive.ssl.SslConfig at 2067924454::credentialConfig=net.shibboleth.idp.authn.impl.X509ResourceCredentialConfig at 7e9c68c1, trustManagers=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=null], useSSL=true, useStartTLS=false, connectionInitializer=null], providerConnectionFactory=[org.ldaptive.provider.jndi.JndiConnectionFactory at 718455963::metadata=[ldapUrl=ldaps://adldaptest.loyola.edu:636, count=1], environment={java.naming.ldap.factory.socket=org.ldaptive.ssl.ThreadLocalTLSSocketFactory, com.sun.jndi.ldap.connect.timeout=3000, java.naming.ldap.version=3, java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory, java.naming.security.protocol=ssl}, providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig at 1063446167::operationExceptionResultCodes=[PROTOCOL_ERROR, SERVER_DOWN], properties={}, connectionStrategy=org.ldaptive.provider.ConnectionStrategies$DefaultConnectionStrategy at e5ab167, controlProcessor=org.ldaptive.provider.ControlProcessor at 352f0e6, environment=null, tracePackets=null, removeDnUrls=true, searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocketFactory=null, hostnameVerifier=null]], providerConnection=org.ldaptive.provider.jndi.JndiConnection at 15dbd4de], result=false, resultCode=INVALID_CREDENTIALS, message=javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903D0, comment: AcceptSecurityContext error, data 773, v2580 ], controls=null] for dn=CN=jmccartin,OU=Loyola,DC=adtest,DC=loyola,DC=edu with request=[org.ldaptive.auth.AuthenticationRequest at 750203460::user=jmccartin, retAttrs=[cn, businessCategory, mail]]
2016-06-30 11:34:58,597 - INFO [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:152] - Profile Action ValidateUsernamePasswordAgainstLDAP: Login by 'jmccartin' failed
I have not modified ClassifiedMessageMap from the default. I have the following in password-authn-config.xml:
<util:map id="shibboleth.authn.Password.ClassifiedMessageMap">
<entry key="UnknownUsername">
<list>
<value>NoCredentials</value>
<value>CLIENT_NOT_FOUND</value>
<value>DN_RESOLUTION_FAILURE</value>
</list>
</entry>
<entry key="InvalidPassword">
<list>
<value>InvalidCredentials</value>
<value>PREAUTH_FAILED</value>
<value>INVALID_CREDENTIALS</value>
</list>
</entry>
<entry key="ExpiredPassword">
<list>
<value>PASSWORD_EXPIRED</value>
</list>
</entry>
<entry key="ExpiringPassword">
<list>
<value>ACCOUNT_WARNING</value>
</list>
</entry>
</util:map>
I have the following in authn-messages.properties:
# Classified Login Error messages
UnknownUsername = bad-username
InvalidPassword = bad-password
ExpiredPassword = expired-password
AccountLocked = account-locked
SPNEGONotAvailable = spnego-unavailable
NTLMUnsupported = ntlm
bad-username.message = The username you entered cannot be identified.
bad-password.message = The password you entered was incorrect.
expired-password.message = Your password has expired.
account-locked.message = Your account is locked.
spnego-unavailable.message = Your web browser doesn't support authentication with your desktop login credentials.
spnego-unavailable.return = Cancel the attempt.
ntlm.message = Your web browser attempted to negotiate a weaker form of desktop authentication.
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Daniel Fisher
Sent: Thursday, June 30, 2016 11:16 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: IdP 3 - Password Expired
On Thu, Jun 30, 2016 at 10:53 AM, James McCartin <jmccartin at loyola.edu<mailto:jmccartin at loyola.edu>> wrote:
Is there something I’m missing?
Looks correct at first glance. Did you modify the ClassifiedMessageMap? Put the org.ldaptive package in DEBUG and confirm you are getting the ppolicy response control back from your directory.
--Daniel Fisher
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160630/8520304b/attachment-0001.html>
More information about the users
mailing list