<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<br>
<div class="moz-cite-prefix">On 3/10/2014 2:41 PM, David Bantz
wrote:<br>
</div>
<blockquote cite="mid:6DE44F6F-3BBD-4661-875B-C19F33AA25FA@gmx.us"
type="cite">
<pre wrap="">How does the IdP’s authentication handler, configured to query AD, react to ‘security context errors’ from AD that indicate the submitted password did match that in the target record but the account is marked as “not permitted to login” or “expired” (and other possible conditions)? [The use case is a service available by business rules to prior students and employees even if they are not eligible for other domain services. This service currently relies on a mix of ad hoc and CAS for authN, but I am trying to be ready for eventual Shibb integration as per stated direction.]
David Bantz
U Alaska</pre>
</blockquote>
<br>
In any LDAP query to AD for a user, always add:<br>
(!(userAccountControl:1.2.840.113556.1.4.803:=2))<br>
to test if account is not disabled. <br>
<br>
This works from the IDP. <br>
<br>
See<br>
<a class="moz-txt-link-freetext" href="http://support.microsoft.com/kb/269181">http://support.microsoft.com/kb/269181</a><br>
<a class="moz-txt-link-freetext" href="http://blogs.msdn.com/b/muaddib/archive/2008/10/08/query-individual-properties-of-the-useraccountcontrol-active-directory-user-property.aspx">http://blogs.msdn.com/b/muaddib/archive/2008/10/08/query-individual-properties-of-the-useraccountcontrol-active-directory-user-property.aspx</a><br>
<br>
In the login.config Consider using
com.sun.security.auth.module.Krb5LoginModule<br>
rather the LDAP for authentication. <br>
<br>
<br>
Even if the x509-login-handler or kerberos-login-handler are used
which don't require a password,<br>
in your the data connector make sure the account is not disabled:<br>
<br>
(&(objectClass=user)(sAMAccountName=$instancePrincipalName.get(0))(!(userAccountControl:1.2.840.113556.1.4.803:=2)))<br>
<br>
(instancePrincipalName was derived from the username from
user/pasword or kerberos principal name from kerberos-login-handler
without the @realm.)<br>
<br>
<br>
<blockquote cite="mid:6DE44F6F-3BBD-4661-875B-C19F33AA25FA@gmx.us"
type="cite">
<pre wrap="">
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">--
To unsubscribe from this list send an email to <a class="moz-txt-link-abbreviated" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></pre>
</blockquote>
<br>
<pre class="moz-signature" cols="200">--
Douglas E. Engert <a class="moz-txt-link-rfc2396E" href="mailto:DEEngert@gmail.com"><DEEngert@gmail.com></a>
</pre>
</body>
</html>