LDAP allow authentication for "account expired" error codes

[IAM David Bantz]

We get that the normal flow is the AD bind attempt fails if the account is
expired with the generic "49" bind failed and data code 701 indicating that
while the user account / password combination is correct but the account is
expired.

For local historical reasons, a few key services want to allow such
accounts to access in that scenario. Accounts for former students and
employees expire, but are entitled to a small subset of services. We do
have a means of doing so with our IdP - a proxy in front of the LDAP (AD)
that intercepts the message (error 49, data code 701) and re-writes that to
a "success" response to the IdP. That proxy service is configured as a
failover (4th in line after "normal" AD instances fail to authenticate the
user) has too often been a point of failure; I was hoping we could get the
Shibb IdP to fulfill that purpose more reliably.

Thanks Scott and Peter; we can function with what we have for now.

David St Pierre Bantz

On Tue, May 6, 2025 at 2:08 PM Peter Schober via users <users at shibboleth.net>
wrote:

> Cantor, Scott via users <users at shibboleth.net> [2025-05-06 23:38 CEST]:
> > By that time, it's already failed.
>
> In slightly other words: The LDAP return code in these case is 49
> "invalid credentials",
> https://www.rfc-editor.org/rfc/rfc4511#section-4.1.9
> i.e., the server rejected the bind request.
> Everything else is here merely decoration of that result, cf.
>
> https://ldapwiki.com/wiki/Wiki.jsp?page=Common%20Active%20Directory%20Bind%20Errors
>
> (via https://www.ldaptive.org/docs/guide/authentication/accountstate
> but the link to the ldapwiki there is broken).
>
> HTH,
> -peter
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250506/abc66ba9/attachment.htm>