LDAP allow authentication for "account expired" error codes

[Jan Marek]

Hello,

if you are using AD directly, there is possibility to filter out
users with disabled accounts via setting of LDAP filter,
somethink like:

idp.authn.LDAP.userFilter = (&(samaccountname={user})(&(userAccountControl=*)(!(userAccountControl:1.2.840.113556.1.4.803:=2))))

See:

https://stackoverflow.com/questions/31180526/active-directory-ldap-query-want-to-filter-out-disabled-users-but-property-mi

Sincerely
Jan Marek

Dne st, kvě 07, 2025 at 01:34:30 CEST napsal(a) IAM David Bantz via users:
> We get that the normal flow is the AD bind attempt fails if the account is
> expired with the generic "49" bind failed and data code 701 indicating that
> while the user account / password combination is correct but the account is
> expired.
> For local historical reasons, a few key services want to allow such accounts to
> access in that scenario. Accounts for former students and employees expire, but
> are entitled to a small subset of services. We do have a means of doing so with
> our IdP - a proxy in front of the LDAP (AD) that intercepts the message (error
> 49, data code 701) and re-writes that to a "success" response to the IdP. That
> proxy service is configured as a failover (4th in line after "normal" AD
> instances fail to authenticate the user) has too often been a point of failure;
> I was hoping we could get the Shibb IdP to fulfill that purpose more reliably.
> Thanks Scott and Peter; we can function with what we have for now.
> David St Pierre Bantz
> 
> On Tue, May 6, 2025 at 2:08 PM Peter Schober via users <users at shibboleth.net>
> wrote:
> 
> Cantor, Scott via users <users at shibboleth.net> [2025-05-06 23:38 CEST]:
> > By that time, it's already failed.
> In slightly other words: The LDAP return code in these case is 49
> "invalid credentials", https://www.rfc-editor.org/rfc/rfc4511#section-4.1.9
> i.e., the server rejected the bind request.
> Everything else is here merely decoration of that result, cf.
> https://ldapwiki.com/wiki/Wiki.jsp?page=Common%20Active%20Directory%20Bind%20Err
> ors
> (via https://www.ldaptive.org/docs/guide/authentication/accountstate
> but the link to the ldapwiki there is broken).
> HTH,
> -peter
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

> -- 
> For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net


-- 
Ing. Jan Marek
University of South Bohemia
Academic Computer Centre
Phone: +420389032080
http://www.gnu.org/philosophy/no-word-attachments.cs.html
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20250507/700f7829/attachment.sig>