Expired Password message not displaying. IdP v5

[Peter Schober]

Lipscomb, Gary via users <users at shibboleth.net> [2024-11-13 07:44 CET]:
> 2024-11-13 17:18:35,363 - 10.0.2.2 - INFO [net.shibboleth.idp.authn.impl.LDAPCredentialValidator:216] - Credential Validator ldap: Login by 'user1' failed
> org.ldaptive.LdapException: PASSWORD_EXPIRED:INVALID_CREDENTIALS:
>         at net.shibboleth.idp.authn.impl.LDAPCredentialValidator.doValidate(LDAPCredentialValidator.java:203)
> 
> Is there an entry in messages.properties or ldap.properties that I need to add to get this to work?

Unlikely to be the case if

> The expiring password intercept works.

but you do have this set in your conf/ldap.properties?

> idp.authn.LDAP.usePasswordPolicy = true

See "Account State" on
https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505688/LDAPAuthnConfiguration
for details. Accoring to that section you'd have to set
  <logger name="net.shibboleth.idp" level="TRACE"/>
in conf/logback.xml (and reload-service.sh -id
shibboleth.LoggingService or wait 10min, IIRC) to debug this.

HTH,
-peter