LDAP allow authentication for "account expired" error codes

[Orlandis Brown]

Hi,

We are attempting to re-implement expired account access to some services
within our IdP. This is possible with our current configuration by an AD
authenticator proxy which overwrites the "expired account" error code with
a success code.

We would like to define explicitly within the IdP configuration that an
"expired account" error code should not result in authentication failure
and that attribute resolution should proceed as normal. I see in the
LDAPAuthnConfiguration documentation that there is a mechanism which reads
the response returned by the LDAP authenticator and maps the error code to
its corresponding event and message to be shown to the user. Is there some
way that the error code could be indicated as one that does not trigger an
event and allows authentication to proceed?

Thank you
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250506/5b083949/attachment.htm>