<html><head><meta http-equiv="Content-Type" content="text/html charset=windows-1252"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">Thank you. This is useful generally, but the use case we’re working is sort of the reverse -<div>they want users to gain access (have authenticated identity asserted) EVEN IF</div><div>their AD account is expired or disabled!</div><div><br></div><div>David Bantz<br><div><br><div><blockquote type="cite"><div text="#000000" bgcolor="#FFFFFF">
In any LDAP query to AD for a user, always add:<br>
(!(userAccountControl:1.2.840.113556.1.4.803:=2))<br>
to test if account is not disabled. <br>
<br>
This works from the IDP. <br>
<br>
See<br>
<a class="moz-txt-link-freetext" href="http://support.microsoft.com/kb/269181">http://support.microsoft.com/kb/269181</a><br>
<a class="moz-txt-link-freetext" href="http://blogs.msdn.com/b/muaddib/archive/2008/10/08/query-individual-properties-of-the-useraccountcontrol-active-directory-user-property.aspx">http://blogs.msdn.com/b/muaddib/archive/2008/10/08/query-individual-properties-of-the-useraccountcontrol-active-directory-user-property.aspx</a><br>
<br>
In the login.config Consider using
com.sun.security.auth.module.Krb5LoginModule<br>
rather the LDAP for authentication. <br>
<br>
<br>
Even if the x509-login-handler or kerberos-login-handler are used
which don't require a password,<br>
in your the data connector make sure the account is not disabled:<br>
<br>
(&(objectClass=user)(sAMAccountName=$instancePrincipalName.get(0))(!(userAccountControl:1.2.840.113556.1.4.803:=2)))<br>
<br>
(instancePrincipalName was derived from the username from
user/pasword or kerberos principal name from kerberos-login-handler
without the @realm.)<br>
<br>
<br>
<blockquote cite="mid:6DE44F6F-3BBD-4661-875B-C19F33AA25FA@gmx.us" type="cite">
<pre wrap="">
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">--
To unsubscribe from this list send an email to <a class="moz-txt-link-abbreviated" href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></pre>
</blockquote>
<br>
<pre class="moz-signature" cols="200">--
Douglas E. Engert <a class="moz-txt-link-rfc2396E" href="mailto:DEEngert@gmail.com"><DEEngert@gmail.com></a>
</pre>
</div>
--<br>To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a></blockquote></div><br></div></div></body></html>