<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">On Sat, Feb 6, 2016 at 2:34 AM, joller lee <span dir="ltr"><<a href="mailto:joller.lee@gmail.com" target="_blank">joller.lee@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><div>Sorry, but I don't understand exactly what you meant by "plus some configured password age".</div><div>To be sure, I'd like to ask again:</div><div>Is it possible to obtain password-about-to-expire warning with the provided message/event mapping mechanism?</div><div>Could you detail on that? (Or give some references, of course)</div></div></div></div></blockquote><div><br></div><div>You'll need to edit ldap-authn-config.xml. Update the <span>Acti</span><span>veDirectoryAuthenticationResponseHandler</span> to include a password age and provide an entry resolver that can resolve the pwdLastSet attribute. I've updated the wiki to include an example:</div><div><br></div><div><a href="https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration#LDAPAuthnConfiguration-Usinganentryresolvertogeneratepasswordexpirationwarnings">https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration#LDAPAuthnConfiguration-Usinganentryresolvertogeneratepasswordexpirationwarnings</a><br></div><div><br></div><div>Let me know if that works for you.</div><div><br></div><div>--Daniel Fisher</div><div><br></div></div></div></div>