<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">On Wed, Feb 10, 2016 at 1:38 PM, Daniel Fisher <span dir="ltr"><<a href="mailto:dfisher@vt.edu" target="_blank">dfisher@vt.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><span class=""><div><br></div></span><div>You'll need to edit ldap-authn-config.xml. Update the <span>Acti</span><span>veDirectoryAuthenticationResponseHandler</span> to include a password age and provide an entry resolver that can resolve the pwdLastSet attribute. I've updated the wiki to include an example:</div><div><br></div><div><a href="https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration#LDAPAuthnConfiguration-Usinganentryresolvertogeneratepasswordexpirationwarnings" target="_blank">https://wiki.shibboleth.net/confluence/display/IDP30/LDAPAuthnConfiguration#LDAPAuthnConfiguration-Usinganentryresolvertogeneratepasswordexpirationwarnings</a><br></div><div><br></div><div>Let me know if that works for you.</div></div></div></div></blockquote><div><br></div><div>With this method, an AccountState(accountWarning) with expiration time is always returned as the result of ValidateUsernamePasswordAgainstLDAP, and the "password expiring" warning view is displayed.</div><div>I guess some customization is needed to determine whether the password is really expiring.</div><div>By the way, with the latest version of ldaptive, a warning period can be designated, by which no customization is needed.</div><div><br></div><div>PS. I use Samba 4 and non-privileged users can read the pwdLastSet attribute. Is an entry resolver still needed in this case?</div><div><br></div></div></div></div>