password expiration - password control result

[joller lee]

On Thu, Mar 31, 2016 at 10:50 PM, Daniel Fisher <dfisher at vt.edu> wrote:

> On Thu, Mar 31, 2016 at 7:24 AM, Andy Thompson <
> athompson at thompsonsplace.net> wrote:
>
>> Is there a way to capture those in the password-authn-config?
>>
>
> Modify your config as follows:
>
> Add a bean to process the controls
> <bean id="authenticationResponseHandler"
>
>  class="org.ldaptive.auth.ext.PasswordExpirationAuthenticationResponseHandler"
> />
>
> Wire that bean to the Authenticator that you are using with:
>   p:authenticationResponseHandlers-ref="authenticationResponseHandler"
>
> You should then be able to use
> the shibboleth.authn.Password.ClassifiedMessageMap.
>
>
Does it work in case of AD ?

My problem maybe differs from Andy's, but I think it's related.
(and sorry for the digression if it's not).
In my attempt to handle password-must-change in AD,
I'm trying to map it to Account-Warning to handle it.
But it's simply treated as login failure, and event though the
password-expiration subflow is triggered,
something like subject c14n context is missing.
Is there any simple way of treating password-must-change as login success
in case of AD.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160401/2ce80995/attachment.html>