password expiration intercept code example request

[David Alexander]

Thanks for sharing this example.

Does the "org.joda.time.format.DateTimeFormat" reference work
in expiring-password-intercept-config.xml in Shib 4.1.x?

I thought that was deprecated a while back.

On Fri, Jan 6, 2023 at 10:11 AM Lee Foltz via users <users at shibboleth.net>
wrote:

> We did this using epoch time from LDAP password last change date, but used
> this setup to intercept the users when their password is about to expire.
> We display the intercept to people if the password is over 3 years old,
> then show them the intercept every 24 hours to remind them to change
> password.
>
> Hopefully this example will help some.
>
> attribute-resolver.xml
>
>  <AttributeDefinition id="passwordExpiration" xsi:type="ScriptedAttribute"
> >
>         <InputDataConnector ref="myLDAP" attributeNames="shadowLastChange"
> />
>         <Script>
>           <![CDATA[
>             logger =
> Java.type("org.slf4j.LoggerFactory").getLogger("net.shibboleth.idp");
>
>             // get epoch last changed and convert from days to milliseconds
>             logger.info("--- shadowLastChange: {}",
> shadowLastChange.getValues().get(0));
>             String = Java.type("java.lang.String");
>             Long = Java.type("java.lang.Long");
>             pwls = new Long(shadowLastChange.getValues().get(0));
>             pwls = pwls * 24 * 3600 * 1000;
>
>             // convert to Java date
>             Date = Java.type("java.util.Date");
>             expireDate = new Date(pwls);
>
>             // convert to format to match the expiring password intercept
> config
>             SimpleDateFormat = Java.type("java.text.SimpleDateFormat");
>             passwordExpiration.addValue(new
> SimpleDateFormat("yyyyMMdd").format(expireDate));
>             logger.info("--- shadowLastChange Converted: {}", new
> SimpleDateFormat("yyyyMMdd").format(expireDate));
>           ]]>
>         </Script>
>
>
>
> expiring-password-intercept-config.xml
>
>  <bean id="shibboleth.expiring-password.Condition"
> class="net.shibboleth.idp.profile.logic.DateAttributePredicate"
>             c:attribute="passwordExpiration" p:resultIfMissing="true">
>         <constructor-arg name="formatter">
>             <bean class="org.joda.time.format.DateTimeFormat"
> factory-method="forPattern" c:_0="yyyyMMdd" />
>         </constructor-arg>
>         <property name="systemTimeOffset">
>             <bean class="org.joda.time.Duration"
> factory-method="standardDays" c:_0="1095" />
>         </property>
>     </bean>
>
>     <!-- Name of cookie to track when user was last notified. -->
>     <bean id="shibboleth.expiring-password.NotifyCookieName"
> class="java.lang.String" c:_0="shib_idp_exp_pwd" />
>
>     <!-- Interval (milliseconds) between notifications, default is 8
> hours. We changed this to 4 hours -->
>     <bean id="shibboleth.expiring-password.NotifyInterval"
> class="java.lang.Long" c:_0="14400000" />
>
> On Fri, Jan 6, 2023 at 9:59 AM Cantor, Scott via users <
> users at shibboleth.net> wrote:
>
>> > Would the offset be positive if I use the password last changed date?
>>
>> Probably positive "minus the amount of time you want to warn" or
>> something like that. Needless to say it hurts my brain every time I go near
>> it so once it works I leave it alone. But I think you're probably right.
>>
>> I'm just saying it's math, and two operations can always be combined into
>> one, you just have to figure out what the combination of the two is.
>>
>> -- Scott
>>
>>
>> --
>> For Consortium Member technical support, see
>> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
>
> --
> Lee Foltz
> Oakland University - UTS
> Senior Identity and Access Management Engineer
>
> 248-370-2675
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230106/b99a741b/attachment.htm>