IDPv4 LDAP account state

[Andrew Jason Morgan]

I *think* this should work for any directory servers that support the password policy standard - OpenLDAP and ODSEE, at least.

On https://wiki.shibboleth.net/confluence/display/IDP4/LDAPAuthnConfiguration, under Advanced Features > Account State, I don't see why we would include the Spring configuration for adding the handlers.  That is taken care of automatically with the usePasswordPolicy property.  Should I update the page by removing the Spring Configuration block and adding the property instead?  I'm happy to help if you want me to.

Thanks,
Andy

________________________________
From: users <users-bounces at shibboleth.net> on behalf of Cantor, Scott <cantor.2 at osu.edu>
Sent: Tuesday, February 16, 2021 12:27 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: IDPv4 LDAP account state

[This email originated from outside of OSU. Use caution with links and attachments.]

On 2/16/21, 3:16 PM, "users on behalf of Andrew Jason Morgan" <users-bounces at shibboleth.net on behalf of morgan at oregonstate.edu> wrote:

>    After setting up some tests and cranking up the logging, I found that all I needed to do was set
> idp.authn.LDAP.usePasswordPolicy=true.  This flag adds the PasswordPolicyAuthenticationRequestHandler() and
> PasswordPolicyAuthenticationResponseHandler() handlers to the Authenticator.  I didn't need to modify beans to add the
> handlers.

That's good, thanks. I think it's pretty directory-specific unfortunately but good to know it can work at least. The idea was to try and auto-wire as much as possible with simple flags, it's just not maintainable to expose all those objects nor would anybody want to see them.

I guess it would be good to maintain a list of the systems it seems to work for.

-- Scott


--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210216/b379eae1/attachment.htm>