Expired Password message not displaying. IdP v5
Lipscomb, Gary
glipscomb at csu.edu.au
Thu Nov 14 02:05:20 UTC 2024
Hi Peter,
When the password has expired we get our custom bad-password.message from messages.properties, not the default "Your password has expired" message.
ldap.properties
idp.authn.LDAP.authenticator = bindSearchAuthenticator
idp.authn.LDAP.usePasswordPolicy = true
idp.authn.LDAP.usePasswordExpiration = true
TRACE output
2024-11-14 12:17:27,738 - 10.0.2.2 - TRACE [net.shibboleth.idp.profile.support.RethrowingFlowHandlerAdapter:405] - Applying default cacheSeconds=0
2024-11-14 12:17:27,739 - 10.0.2.2 - TRACE [net.shibboleth.idp.profile.support.ProfileRequestContextFlowExecutionListener:62] - Updating ProfileRequestContext in servlet request
2024-11-14 12:17:27,739 - 10.0.2.2 - TRACE [net.shibboleth.idp.ui.csrf.impl.CSRFTokenFlowExecutionListener:155] - Event 'proceed' signaled from view 'DisplayUsernamePasswordPage' requires a CSRF token
2024-11-14 12:17:27,740 - 10.0.2.2 - TRACE [net.shibboleth.idp.ui.csrf.impl.CSRFTokenFlowExecutionListener:180] - Stored (viewScoped) CSRF Token '_adace3b3019d25394f0e3cfd53163b27796c38e1',
CSRF Token in HTTP request '_adace3b3019d25394f0e3cfd53163b27796c38e1'
2024-11-14 12:17:27,742 - 10.0.2.2 - TRACE [net.shibboleth.idp.authn.impl.ValidateCredentials:183] - Profile Action ValidateCredentials: Attempting credential validation via ldap
2024-11-14 12:17:27,742 - 10.0.2.2 - TRACE [net.shibboleth.idp.authn.AbstractUsernamePasswordCredentialValidator:290] - Credential Validator ldap: Trimming whitespace of input string 'REDACTED_USER'
2024-11-14 12:17:27,742 - 10.0.2.2 - DEBUG [net.shibboleth.idp.authn.impl.LDAPCredentialValidator:147] - Credential Validator ldap: Attempting to authenticate user REDACTED_USER
2024-11-14 12:17:27,742 - 10.0.2.2 - TRACE [net.shibboleth.idp.authn.TemplateSearchDnResolver:242] - resolve user=[org.ldaptive.auth.User at 225729519::identifier=REDACTED_USER,
context=org.apache.velocity.VelocityContext at 57f5c5c9]
2024-11-14 12:17:27,963 - 10.0.2.2 - DEBUG [net.shibboleth.idp.authn.TemplateSearchDnResolver:278] - Resolved dn=uid=REDACTED_USER,ou=People,o=REDACTED
for user=[org.ldaptive.auth.User at 225729519::identifier=REDACTED_USER, context=org.apache.velocity.VelocityContext at 57f5c5c9]
2024-11-14 12:17:28,102 - 10.0.2.2 - DEBUG [net.shibboleth.idp.authn.impl.LDAPCredentialValidator:173] - Credential Validator ldap: Authentication response [org.ldaptive.auth.AuthenticationResponse at -1282951634
::authenticationHandlerResponse=[org.ldaptive.auth.AuthenticationHandlerResponse at 1428864695
::connection=org.ldaptive.transport.netty.NettyConnection at 2111045129
::ldapUrl=[org.ldaptive.LdapURL at 876348420
::scheme=ldap, hostname=REDACTED.REDACTED, port=-1, baseDn=null, attributes=null, scope=null, filter=null, inetAddress=null], isOpen=true, connectTime=2024-11-14T01:11:41.705813678Z,
connectionConfig=[org.ldaptive.ConnectionConfig at 1344972102
::ldapUrl=ldap://REDACTED.REDACTED, connectTimeout=PT3S, startTLSTimeout=PT3S, responseTimeout=PT3S, reconnectTimeout=PT10S, autoReconnect=true,
autoReconnectCondition=ONE_RECONNECT_ATTEMPT, autoReplay=false, sslConfig=[org.ldaptive.ssl.SslConfig at 1087228013
::credentialConfig=net.shibboleth.idp.authn.impl.X509ResourceCredentialConfig at 2f8837b8, trustManagers=null, hostnameVerifier=null, enabledCipherSuites=null, enabledProtocols=null,
handshakeCompletedListeners=null, handshakeTimeout=PT1M], useStartTLS=false, connectionInitializers=null, connectionStrategy=[org.ldaptive.ActivePassiveConnectionStrategy at 2019751596
::ldapURLSet=[org.ldaptive.LdapURLSet at 1010303001
::active=[[org.ldaptive.LdapURL at 876348420
::scheme=ldap, hostname=REDACTED.REDACTED, port=-1, baseDn=null, attributes=null, scope=null, filter=null, inetAddress=null]], inactive=[]], activateCondition=DEFAULT_ACTIVATE_CONDITION,
retryCondition=DEFAULT_RETRY_CONDITION, initialized=true], connectionValidator=null, transportOptions={}], channel=[id: 0x2731fa11, L:/10.0.2.15:58800 - R:REDACTED.REDACTED/REDACTED.69.157:389],
authenticationResultCode=AUTHENTICATION_HANDLER_FAILURE, resultCode=INVALID_CREDENTIALS, matchedDN=, diagnosticMessage=, referralURLs=[], messageID=6,
controls=[[org.ldaptive.control.PasswordPolicyControl at 1756844979
::criticality=false, timeBeforeExpiration=-1, graceAuthNsRemaining=-1, error=PASSWORD_EXPIRED]]], resolvedDn=uid=REDACTED_USER,ou=People,o=REDACTED, ldapEntry=org.ldaptive.LdapEntry at 165355790
::messageID=0, controls=[], dn=uid=REDACTED_USER,ou=People,o=REDACTED, attributes=[], accountState=[org.ldaptive.auth.ext.PasswordPolicyAccountState at 1945312126
::accountWarnings=null,
accountErrors=[PASSWORD_EXPIRED]], resultCode=INVALID_CREDENTIALS,
matchedDN=, diagnosticMessage=, referralURLs=[], messageID=6, controls=[[org.ldaptive.control.PasswordPolicyControl at 1756844979
::criticality=false, timeBeforeExpiration=-1, graceAuthNsRemaining=-1,
error=PASSWORD_EXPIRED]]]
2024-11-14 12:17:28,219 - 10.0.2.2 - INFO [net.shibboleth.idp.authn.impl.LDAPCredentialValidator:216] - Credential Validator ldap: Login by 'REDACTED_USER' failed
org.ldaptive.LdapException: PASSWORD_EXPIRED:INVALID_CREDENTIALS:
at net.shibboleth.idp.authn.impl.LDAPCredentialValidator.doValidate(LDAPCredentialValidator.java:203)
2024-11-14 12:17:28,244 - 10.0.2.2 - TRACE [net.shibboleth.idp.profile.support.RethrowingFlowHandlerAdapter:405] - Applying default cacheSeconds=0
2024-11-14 12:17:28,244 - 10.0.2.2 - TRACE [net.shibboleth.idp.profile.support.ProfileRequestContextFlowExecutionListener:62] - Updating ProfileRequestContext in servlet request
2024-11-14 12:17:28,250 - 10.0.2.2 - TRACE [net.shibboleth.idp.ui.context.RelyingPartyUIContext:551] - GetServiceName - looking browser Locales '{}', Falllback locales '{}'
2024-11-14 12:17:28,250 - 10.0.2.2 - TRACE [net.shibboleth.idp.ui.context.RelyingPartyUIContext:553] - Looking in UI info for Browser Locales
2024-11-14 12:17:28,251 - 10.0.2.2 - DEBUG [net.shibboleth.idp.ui.context.RelyingPartyUIContext:574] - Found Name 'EASTS qa' for Locale 'en'
2024-11-14 12:17:28,251 - 10.0.2.2 - DEBUG [net.shibboleth.idp.ui.context.RelyingPartyUIContext:847] - No valid logos which fit found
2024-11-14 12:17:28,251 - 10.0.2.2 - TRACE [net.shibboleth.idp.ui.context.RelyingPartyUIContext:592] - GetServiceDescription - looking browser Locales '{}', Falllback locales '{}'
2024-11-14 12:17:28,252 - 10.0.2.2 - TRACE [net.shibboleth.idp.ui.context.RelyingPartyUIContext:594] - Looking in UI info for Browser Locales
2024-11-14 12:17:28,252 - 10.0.2.2 - TRACE [net.shibboleth.idp.ui.context.RelyingPartyUIContext:604] - Looking in UI info for Fallback Locales
2024-11-14 12:17:28,252 - 10.0.2.2 - DEBUG [net.shibboleth.idp.ui.context.RelyingPartyUIContext:619] - Nothing found
regards
Gary
Gary Lipscomb
Technical Officer, Systems
IT Infrastructure & Security | Division of Information Technology
________________________________
From: users <users-bounces at shibboleth.net> on behalf of Peter Schober via users <users at shibboleth.net>
Sent: Thursday, 14 November 2024 01:28
To: users at shibboleth.net <users at shibboleth.net>
Cc: Peter Schober <peter.schober at univie.ac.at>
Subject: Re: Expired Password message not displaying. IdP v5
Lipscomb, Gary via users <users at shibboleth.net> [2024-11-13 07:44 CET]:
> 2024-11-13 17:18:35,363 - 10.0.2.2 - INFO [net.shibboleth.idp.authn.impl.LDAPCredentialValidator:216] - Credential Validator ldap: Login by 'user1' failed
> org.ldaptive.LdapException: PASSWORD_EXPIRED:INVALID_CREDENTIALS:
> at net.shibboleth.idp.authn.impl.LDAPCredentialValidator.doValidate(LDAPCredentialValidator.java:203)
>
> Is there an entry in messages.properties or ldap.properties that I need to add to get this to work?
Unlikely to be the case if
> The expiring password intercept works.
but you do have this set in your conf/ldap.properties?
> idp.authn.LDAP.usePasswordPolicy = true
See "Account State" on
https://aus01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fspaces%2FIDP5%2Fpages%2F3199505688%2FLDAPAuthnConfiguration&data=05%7C02%7Cglipscomb%40csu.edu.au%7Cdc96584c839f4b3a6e0a08dd03ef73de%7Cf0f76207a6104fc0b4a35d797fe5283c%7C0%7C0%7C638671049196466833%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=AarS%2F84EuF7iGnywn9umqSbezIUczRcWMeFqVPEG2sE%3D&reserved=0<https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505688/LDAPAuthnConfiguration>
for details. Accoring to that section you'd have to set
<logger name="net.shibboleth.idp" level="TRACE"/>
in conf/logback.xml (and reload-service.sh -id
shibboleth.LoggingService or wait 10min, IIRC) to debug this.
HTH,
-peter
--
For Consortium Member technical support, see https://aus01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fx%2FZYEpPw&data=05%7C02%7Cglipscomb%40csu.edu.au%7Cdc96584c839f4b3a6e0a08dd03ef73de%7Cf0f76207a6104fc0b4a35d797fe5283c%7C0%7C0%7C638671049196486905%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=Tg%2FFc6qpPxO2Ync4wWWG1lyVJiF3HwktGAMQ4wPmAKI%3D&reserved=0<https://shibboleth.atlassian.net/wiki/x/ZYEpPw>
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
[Charles Sturt]<https://www.csu.edu.au/>
________________________________
LEGAL NOTICE
This email (including correspondence comprising an email chain and any attachment) is confidential and is intended for the use of the addressee(s) only. If you are not the intended recipient of this email, you must not copy, distribute, take any action in reliance on it or disclose it to anyone.
Any confidentiality is not waived or lost by reason of mistaken delivery. Any email should be checked for viruses and defects before opening. Charles Sturt University does not accept liability for viruses or any consequence which arise as a result of this email transmission. Email communications with Charles Sturt University may be subject to automated email filtering, which could result in the delay or deletion of a legitimate email before it is read at Charles Sturt University. The views expressed in this email are not necessarily those of Charles Sturt University.
Charles Sturt University in Australia<https://www.csu.edu.au/> The Grange Chancellery, Panorama Avenue, Bathurst NSW Australia 2795 (ABN: 83 878 708 551). Charles Sturt University - TEQSA Provider Identification: PRV12018 (Australian University). CRICOS Provider: 00005F.
Consider the environment before printing this email.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20241114/f6f727fe/attachment.htm>
More information about the users
mailing list