A bit lost on how tu trigger username-password validation against LDAP in IDPV4

[Claude Libois]

Hello,
We are currently upgrading from idp 3.4.3 to idp 4.0.x
I our 3.4.x flow we used to trigger username/password against ldap in a
flow:

<action-state id="ValidateUsernamePassword"
parent="authn/conditions#ValidateUsernamePassword">
    <evaluate expression="ValidateUsernamePassword" />
    <evaluate expression="'proceed'" />

    <transition on="proceed" to="ContinueSuccessfulAuthentication" />

    <!-- Fall through to a different flow if login fails on a passive
or non-browser request. -->
    <transition on="#{
opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).isPassive()
|| !opensamlProfileRequestContext.isBrowserProfile() }"
to="ReselectFlow" />

    <!-- Other event transitions are determined by deployer in
/flows/authn/conditions/conditions-flow.xml -->
</action-state>

and the beans was containing

<bean id="ValidateUsernamePasswordAgainstLDAP"
        class="net.shibboleth.idp.authn.impl.LDAPCredentialValidator"
scope="prototype"
        p:savePasswordToCredentialSet="#{getObject('shibboleth.authn.Password.RetainAsPrivateCredential')
?: false}"
        p:removeContextAfterValidation="#{getObject('shibboleth.authn.Password.RemoveAfterValidation')
?: true}"
        p:authenticator-ref="shibboleth.authn.LDAP.authenticator"
        p:supportedPrincipals="#{getObject('shibboleth.authn.Password.PrincipalOverride')}"
        p:matchExpression="#{getObject('shibboleth.authn.Password.matchExpression')}"
        p:returnAttributes-ref="shibboleth.authn.LDAP.returnAttributes"
        />
        <bean id="PopulateSubjectCanonicalizationContext"
        class="net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext"
scope="prototype"
        p:availableFlows-ref="shibboleth.PostLoginSubjectCanonicalizationFlows"
/>

</beans>

The alias ValidateUsernamePassword was defined with the alias
  <alias name="ValidateUsernamePasswordAgainstLDAP"
alias="ValidateUsernamePassword" />  in the password-authn-conf.xml

I have noticed there was quite a lot of changes in the way of defining the
validate user/pwd against LDAP. The class
ValidateUsernamePasswordAgainstLDAP  no more exist and I have replace it
with the LDAPCredentialValidator:

<bean id="ValidateUsernamePasswordAgainstLDAP"
        class="net.shibboleth.idp.authn.impl.LDAPCredentialValidator"
scope="prototype"
        p:savePasswordToCredentialSet="#{getObject('shibboleth.authn.Password.RetainAsPrivateCredential')
?: false}"
        p:removeContextAfterValidation="#{getObject('shibboleth.authn.Password.RemoveAfterValidation')
?: true}"
        p:authenticator-ref="shibboleth.authn.LDAP.authenticator"
        p:supportedPrincipals="#{getObject('shibboleth.authn.Password.PrincipalOverride')}"
        p:matchExpression="#{getObject('shibboleth.authn.Password.matchExpression')}"
        p:returnAttributes-ref="shibboleth.authn.LDAP.returnAttributes"
        />
        <bean id="PopulateSubjectCanonicalizationContext"
        class="net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext"
scope="prototype"
        p:availableFlows-ref="shibboleth.PostLoginSubjectCanonicalizationFlows"
/>

</beans>


However, the doValidate of the  LDAPCredentialValidator is never
triggered.
I have read the
https://wiki.shibboleth.net/confluence/display/IDP4/PasswordAuthnConfiguration
There is an alternative to the alias  ValidateUsernamePassword.
I have then updated my  password-authn-config and ldap-authn-config by
disabling the alias and adding:
<util:list id="shibboleth.authn.Password.Validators">
<ref bean="shibboleth.LDAPValidator" />
</util:list>

However, I don't know how to wire the shibboleth.LDAPValidator with my
ValidateUsernamePasswordAgainstLDAP.
Moreover, I don't know how to trigger the doValidate from the
ValidateUsernamePasswordAgainstLDAP.

Could somebody point me on how to trigger the validation manually or what
are the "convention" to have the password against LDAP triggered after
having submit the j_username and j_password ?
Best Regards,
Claude
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210505/ea69e8ac/attachment.htm>