<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div class=""><blockquote type="cite" class=""><div class=""><div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><div apple-content-edited="true" class=""><br class=""></div><div apple-content-edited="true" style="orphans: 2; widows: 2; " class="">So, given one configures to allow multiple DNs, the first one found in the collection will then determine which LDAP instance the BIND attempt as the user will be done with, correct? </div><div apple-content-edited="true" class=""><br class=""></div></div></div></blockquote><br class=""></div><div class="">And, more to the point, if you want the SUFFICIENT behavior of JAAS, you need to use JAAS, you can't easily get it to try the second DN in the collection if the first one chosen "fails"?</div><div class=""><br class=""></div></div></blockquote><br class=""></div><div>So one "on the surface" advantage of using the LDAP config versus the JAAS config with v3 is the more obvious documented support for handling LDAP error codes/expiring passwords etc. with the LDAP config. But looking back, I see that even with v2 one could add:</div><div><br class=""></div><div> <span style="font-family: Verdana, Geneva, Helvetica, Arial, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class="">authenticationControls="org.ldaptive.control.PasswordPolicyControl"</span><span style="font-family: Verdana, Geneva, Helvetica, Arial, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class=""> </span></div><div><span style="font-family: Verdana, Geneva, Helvetica, Arial, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class=""><br class=""></span></div><div><span style="font-family: Verdana, Geneva, Helvetica, Arial, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class="">to the JAAS config (if one included the Ldaptive jar). So is using the exact same password policy support in v3 with JAAS as simple as adding that above line if it is OpenLDAP, and as simple as adding something like:</span></div><div><br class=""></div><span style="font-family: Verdana, Geneva, Helvetica, Arial, sans-serif; font-size: 13px; background-color: rgb(255, 255, 255);" class=""> authenticationControls="</span><font face="Verdana, Geneva, Helvetica, Arial, sans-serif" class=""><span style="font-size: 13px;" class="">org.ldaptive.auth.ext.ActiveDirectoryAuthenticationResponseHandler"</span></font><div class=""><font face="Verdana, Geneva, Helvetica, Arial, sans-serif" class=""><span style="font-size: 13px;" class=""><br class=""></span></font></div><div class=""><font face="Verdana, Geneva, Helvetica, Arial, sans-serif" class=""><span style="font-size: 13px;" class="">if an AD source? Or does the latter only work if using the Ldaptive ldap-authn?<br class=""></span></font><div class="">
<br class="">--<br class="">Michael A. Grady<br class="">IAM Architect, Unicon, Inc.
</div>
<br class=""></div></body></html>