LDAP allow authentication for "account expired" error codes

[Fisher, Daniel]

From: users <users-bounces at shibboleth.net> on behalf of IAM David Bantz via users <users at shibboleth.net>
Date: Tuesday, May 6, 2025 at 7:35 PM
To: Shib Users <users at shibboleth.net>
Cc: IAM David Bantz <dabantz at alaska.edu>
Subject: Re: LDAP allow authentication for "account expired" error codes
We get that the normal flow is the AD bind attempt fails if the account is expired with the generic "49" bind failed and data code 701 indicating that while the user account / password combination is correct but the account is expired.

For local historical reasons, a few key services want to allow such accounts to access in that scenario. Accounts for former students and employees expire, but are entitled to a small subset of services. We do have a means of doing so with our IdP - a proxy in front of the LDAP (AD) that intercepts the message (error 49, data code 701) and re-writes that to a "success" response to the IdP. That proxy service is configured as a failover (4th in line after "normal" AD instances fail to authenticate the user) has too often been a point of failure; I was hoping we could get the Shibb IdP to fulfill that purpose more reliably.

If you could file an issue I’ll take a look at the scope of work to support this functionality. In general, it would require a custom authentication handler to change the bind failure to a success when certain data codes are encountered. That’s not a component that currently exists, but if it’s useful to the AD community, it can be added.

--Daniel Fisher

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250507/77cfd594/attachment.htm>