I'm trying to work out the logic to send users to our password management frontend if their passwords are expired or coming up for expiration when they login to a shibboleth 3 IdP. The issue I seem to be coming across is that the resultCode for both a wrong password and an expired password are sent with a resultCode= INVALID_CREDENTIALS from 389 with additional information in the response message "LDAP: error code 49 - password expired!"

389 sends additional controls for passwords that are logged as below

- password coming for expiration

controls=[[org.ldaptive.control.PasswordExpiringControl@-828304999::criticality=false, timeBeforeExpiration=74849]]]

- password expired

controls=[[org.ldaptive.control.PasswordExpiredControl@-828432802::criticality=false]]]

Is there a way to capture those in the password-authn-config?

thanks

-andy