EDirectory authenticationHandler issue

[Cantor, Scott]

On 4/6/21, 5:43 PM, "users on behalf of Herron, Joel D" <users-bounces at shibboleth.net on behalf of herronj at uww.edu> wrote:

>    any ideas welcome. Is there a way to disable the built-in password expiring mechanism until after we
> upgrade.

There is nothing "built-in". If the LDAP server doesn't return an error from a bind, then the IdP is fine. If you impose some other check by installing some kind of special response handler, just...don't do that.

If the LDAP server isn't claiming success, you'd have to fix that on the other end because the IdP isn't the part rejecting the bind.

Alternatively just ignore the issue and upgrade because the LDAP code is different, the client library is different, and the entire file you're worrying about there is (or can be) gone in 4.1 entirely. Just start from scratch re: authentication. Normally that wouldn't be the strongest play but here I'd say you might save yourself time, potentially.

-- Scott