shibboleth.expiring-password.Condition in v4

[Paul B. Henson]

After considerable headache in the past, I got the expiring password intercept working with this condition:

    <bean id="shibboleth.expiring-password.Condition" class="net.shibboleth.idp.profile.logic.DateAttributePredicate"
            c:attribute="shibPasswordExpiration" c:formatString="MMM dd yyyy HH:mm:ss"
            p:resultIfMissing="true" p:offset="-P5D" />

and a scripted attribute defined as:

                    if (typeof cppEduPersonPwdExpiration != "undefined") {
                        var dateString =
                          (new Date(cppEduPersonPwdExpiration.getValues().get(0)*1000)).toLocaleString();

                        dateString = dateString.substring(0, dateString.length()-15);
                        dateString = dateString.replace(/^[^ ]+ /, '');

                        shibPasswordExpiration.addValue(dateString);
                    }

Sadly, in v4, which the release notes say uses the new Java time formatting stuff, that fails:

2020-08-27 18:33:41,137 - 10.104.223.168/node016cnzz1lmkg37b86qxm9abge817 - WARN [net.shibboleth.idp.profile.logic.DateA
ttributePredicate:208] - Dec 16 2020 23:59:00 is not a valid date for the configured date parser
java.time.DateTimeException: Unable to obtain Instant from TemporalAccessor: {},ISO resolved to 2020-12-16T23:59 of type java.time.format.Parsed
        at java.base/java.time.Instant.from(Instant.java:378)
Caused by: java.time.temporal.UnsupportedTemporalTypeException: Unsupported field: InstantSeconds
        at java.base/java.time.format.Parsed.getLong(Parsed.java:203)

I tried converting my UNIX time_t into the format used by the default configuration ("yyyyMMddHHmmss'T'"), but I can't get back to work either. For your amusement, here are various attempts:

java.time.format.DateTimeParseException: Text '20201217075900' could not be parsed at index 14
java.time.format.DateTimeParseException: Text '20201217075900Z' could not be parsed at index 14
java.time.format.DateTimeParseException: Text '20201217075900-0800' could not be parsed at index 14
java.time.format.DateTimeParseException: Text '20201217075900[UTC]' could not be parsed at index 14

Would someone please spoon feed me how to do this 8-/? My LDAP attribute is a standard UNIX timestamp, I don't think there is any way to parse it directly so it needs to be converted into some other format first, which I am doing in the JavaScript. I'm not sure what the 'T' means in the formatter, unless it is a literal T, just indicating the value is a timestamp? I feel like it is unhappy that there isn't a time zone, but I cannot figure out how to incorporate the time zone in the way it likes. I'm either being particularly stupid today, or this Java time stuff is ridiculously obtuse <sigh>.

Thanks...

--
Paul B. Henson  |  (909) 979-6361  |  http://www.cpp.edu/~henson/
Operating Systems and Network Analyst  |  henson at cpp.edu
California State Polytechnic University  |  Pomona CA 91768