expiring-password intercept triggering unexpectedly

[Liam Hoekenga]

I'm experimenting with the expiring-password intercept.
Based on the date format we're using (e.g. "20190318193555Z"), I had to
update the formatString in the "shibboleth.expiring-password.Condition"
from
    yyyyMMddHHmmss'T'
to
    yyyyMMddHHmmss'Z'

...otherwise I get...
2019-07-22 11:58:00,821 - 141.213.171.202 - INFO
[net.shibboleth.idp.profile.logic.DateAttributePredicate:164] -
20190721193555Z is not a valid date for the configured date parser

The bean definition is otherwise unchanged:
    <bean id="shibboleth.expiring-password.Condition"
class="net.shibboleth.idp.profile.logic.DateAttributePredicate"
            c:attribute="passwordExpiration"
c:formatString="yyyyMMddHHmmss'Z'"
            p:resultIfMissing="true" p:offset="-P14D" />

My reading of the condition is that it should trigger if the expiration
date is within the next 14 days.  The behavior I'm seeing, however, is that
the intercept is display if the "passwordExpiration" attribute is set,
regardless of date.

I looked at the docs for org.joda.time.format.DateTimeFormatter, and I
believe that I have updated the format string appropriately.

Does anyone have suggestions?
Liam
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190722/986f48e3/attachment.html>