EDirectory authenticationHandler issue

[Herron, Joel D]

That makes a lot more sense, as this is an inherited and upgraded from v2 system I never really know what was or wasn't here out of the box/heavily modified, the whole sale removal works for me.

Thanks for the help!

--Joel

On 4/6/21, 6:54 PM, "users on behalf of Cantor, Scott" <users-bounces at shibboleth.net on behalf of cantor.2 at osu.edu> wrote:

    *EXTERNAL EMAIL*

    On 4/6/21, 5:43 PM, "users on behalf of Herron, Joel D" <users-bounces at shibboleth.net on behalf of herronj at uww.edu> wrote:

    >    any ideas welcome. Is there a way to disable the built-in password expiring mechanism until after we
    > upgrade.

    There is nothing "built-in". If the LDAP server doesn't return an error from a bind, then the IdP is fine. If you impose some other check by installing some kind of special response handler, just...don't do that.

    If the LDAP server isn't claiming success, you'd have to fix that on the other end because the IdP isn't the part rejecting the bind.

    Alternatively just ignore the issue and upgrade because the LDAP code is different, the client library is different, and the entire file you're worrying about there is (or can be) gone in 4.1 entirely. Just start from scratch re: authentication. Normally that wouldn't be the strongest play but here I'd say you might save yourself time, potentially.

    -- Scott


    -- 
    For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
    To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net