<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.EmailStyle18
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Sure. The following is DEBUG output from ldaptive packages. I believe we are seeing a successful bind followed by a failed search operation. The search operation
appears to be restricted from the list of current allowed operations. I believe this is due to the fact that the directory is enforcing a password-must-change policy that is active. I am concluding that because search operations are not being restricted
for accounts with normal account state.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">2016-12-12 13:13:23,105 - DEBUG [org.ldaptive.BindOperation:168] - execute response=[org.ldaptive.Response@81455065::result=null, resultCode=SUCCESS<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">, message=null, matchedDn=null, responseControls=[[org.ldaptive.control.PasswordPolicyControl@159938469::criticality=false, timeBeforeExpiration=0,
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">graceAuthNsRemaining=0, error=CHANGE_AFTER_RESET]], referralURLs=null, messageId=-1] for request=[org.ldaptive.BindRequest@1202371144::bindDn=uid=xxxxxx,ou=people,dc=umt,dc=edu,
saslConfig=null, controls=[[org.ldaptive.control.PasswordPolicyControl@-350057371::criticality=false, timeBeforeExpiration=0, graceAuthNsRemaining=0, error=null]]] with connection=[org.ldaptive.DefaultConnectionFactory$DefaultConnection@260634741::config=[org.ldap<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">tive.ConnectionConfig@1845349421::ldapUrl=ldaps://example.umt.edu:636, connectTimeout=3000, responseTimeout=-1, sslConfig=[org.ldaptive.ssl.SslConf<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">ig@1214272534::credentialConfig=net.shibboleth.idp.authn.impl.KeystoreResourceCredentialConfig@4ca1c64e, trustManagers=null, enabledCipherSuites=nul<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">l, enabledProtocols=null, handshakeCompletedListeners=null], useSSL=true, useStartTLS=false, connectionInitializer=null], providerConnectionFactory=<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">[org.ldaptive.provider.jndi.JndiConnectionFactory@2131097089::metadata=[ldapUrl=ldaps://cidptest.umt.edu:636, count=1], environment={java.naming.lda<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">p.factory.socket=org.ldaptive.ssl.ThreadLocalTLSSocketFactory, com.sun.jndi.ldap.connect.timeout=3000, java.naming.ldap.version=3, java.naming.facto<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">ry.initial=com.sun.jndi.ldap.LdapCtxFactory, java.naming.security.protocol=ssl}, providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig@12036<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">09377::operationExceptionResultCodes=[PROTOCOL_ERROR, SERVER_DOWN], properties={}, connectionStrategy=org.ldaptive.provider.ConnectionStrategies$Def<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">aultConnectionStrategy@324998f5, controlProcessor=org.ldaptive.provider.ControlProcessor@29e255d9, environment=null, tracePackets=null, removeDnUrls<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">=true, searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocketFactory=null, hostnameVerifier=null]], provider<a href="mailto:Connection=org.ldaptive.provider.jndi.JndiConnection@3b08d257">Connection=org.ldaptive.provider.jndi.JndiConnection@3b08d257</a>]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">2016-12-12 13:13:23,105 - DEBUG [org.ldaptive.auth.PooledBindAuthenticationHandler:85] - authenticate response=[org.ldaptive.auth.AuthenticationHand<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">lerResponse@1901772651::connection=[org.ldaptive.DefaultConnectionFactory$DefaultConnection@260634741::config=[org.ldaptive.ConnectionConfig@1845349<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">421::ldapUrl=ldaps://example.umt.edu:636, connectTimeout=3000, responseTimeout=-1, sslConfig=[org.ldaptive.ssl.SslConfig@1214272534::credentialConf<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">ig=net.shibboleth.idp.authn.impl.KeystoreResourceCredentialConfig@4ca1c64e, trustManagers=null, enabledCipherSuites=null, enabledProtocols=null, han<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">dshakeCompletedListeners=null], useSSL=true, useStartTLS=false, connectionInitializer=null], providerConnectionFactory=[org.ldaptive.provider.jndi.J<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">ndiConnectionFactory@2131097089::metadata=[ldapUrl=ldaps://example.umt.edu:636, count=1], environment={java.naming.ldap.factory.socket=org.ldaptive<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">.ssl.ThreadLocalTLSSocketFactory, com.sun.jndi.ldap.connect.timeout=3000, java.naming.ldap.version=3, java.naming.factory.initial=com.sun.jndi.ldap.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">LdapCtxFactory, java.naming.security.protocol=ssl}, providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig@1203609377::operationExceptionResu<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">ltCodes=[PROTOCOL_ERROR, SERVER_DOWN], properties={}, connectionStrategy=org.ldaptive.provider.ConnectionStrategies$DefaultConnectionStrategy@324998<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">f5, controlProcessor=org.ldaptive.provider.ControlProcessor@29e255d9, environment=null, tracePackets=null, removeDnUrls=true, searchIgnoreResultCode<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">s=[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocketFactory=null, hostnameVerifier=null]], providerConnection=org.ldaptive.provi<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">der.jndi.JndiConnection@3b08d257], result=true, resultCode=SUCCESS, message=null, controls=[[org.ldaptive.control.PasswordPolicyControl@159938469::c<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">riticality=false, timeBeforeExpiration=0, graceAuthNsRemaining=0, error=CHANGE_AFTER_RESET]]] for criteria=[org.ldaptive.auth.AuthenticationCriteria<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">@1051329388::dn=uid=xxxxxx,ou=people,dc=umt,dc=edu, authenticationRequest=[org.ldaptive.auth.AuthenticationRequest@850478646::user=[org.ldaptive.a<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">uth.User@1890173199::identifier=xxxxxx, context=org.apache.velocity.VelocityContext@3d31c60f], retAttrs=[umid]]]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">2016-12-12 13:13:23,107 - DEBUG [org.ldaptive.auth.SearchEntryResolver:415] - resolve criteria=[org.ldaptive.auth.AuthenticationCriteria@1051329388:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">:dn=uid=xxxxxx,ou=people,dc=umt,dc=edu, authenticationRequest=[org.ldaptive.auth.AuthenticationRequest@850478646::user=[org.ldaptive.auth.User@1890173199::identifier=jo180287,
context=org.apache.velocity.VelocityContext@3d31c60f], retAttrs=[umid]]]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">2016-12-12 13:13:23,107 - DEBUG [org.ldaptive.SearchOperation:138] - execute request=[org.ldaptive.SearchRequest@-742090779::baseDn=uid=xxxxxx,ou=people,dc=umt,dc=edu,
searchFilter=[org.ldaptive.SearchFilter@1642584434::filter=(objectClass=*), parameters={}], returnAttributes=[umid], searchScope=OBJECT, timeLimit=0, sizeLimit=0, derefAliases=null, typesOnly=false, binaryAttributes=null, sortBehavior=UNORDERED, searchEntryHandlers=null,
searchReferenceHandlers=null, controls=null, followReferrals=false, intermediateResponseHandlers=null] with connection=[org.ldaptive.DefaultConnectionFactory$DefaultConnection@260634741::config=[org.ldaptive.ConnectionConfig@1845349421::ldapUrl=ldaps://example.umt.edu:636,
connectTimeout=3000, responseTimeout=-1, sslConfig=[org.ldaptive.ssl.SslConfig@1214272534::credentialConfig=net.shibboleth.idp.authn.impl.KeystoreResourceCredentialConfig@4ca1c64e, trustManagers=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=null],
useSSL=true, useStartTLS=false, connectionInitializer=null], providerConnectionFactory=[org.ldaptive.provider.jndi.JndiConnectionFactory@2131097089::metadata=[ldapUrl=ldaps://example.umt.edu:636, count=1], environment={java.naming.ldap.factory.socket=org.ldaptive.ssl.ThreadLocalTLSSocketFactory,
com.sun.jndi.ldap.connect.timeout=3000, java.naming.ldap.version=3, java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory, java.naming.security.protocol=ssl}, providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig@1203609377::operationExceptionResultCodes=[PROTOCOL_ERROR,
SERVER_DOWN], properties={}, connectionStrategy=org.ldaptive.provider.ConnectionStrategies$DefaultConnectionStrategy@324998f5, controlProcessor=org.ldaptive.provider.ControlProcessor@29e255d9, environment=null, tracePackets=null, removeDnUrls=true, searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED,
SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocketFactory=null, hostnameVerifier=null]],
<a href="mailto:providerConnection=org.ldaptive.provider.jndi.JndiConnection@3b08d257">
providerConnection=org.ldaptive.provider.jndi.JndiConnection@3b08d257</a>]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">2016-12-12 13:13:23,118 - DEBUG [org.ldaptive.auth.Authenticator:404] - entry resolution failed for resolver=[org.ldaptive.auth.SearchEntryResolver@345806538::factory=null,
baseDn=, userFilter=null, userFilterParameters=null, allowMultipleEntries=false, subtreeSearch=false, derefAliases=null, followReferrals=false, searchEntryHandlers=null]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">2016-12-12 13:13:23,118 - DEBUG [org.ldaptive.auth.Authenticator:404] - entry resolution failed for resolver=[org.ldaptive.auth.SearchEntryResolver@345806538::factory=null,
baseDn=, userFilter=null, userFilterParameters=null, allowMultipleEntries=false, subtreeSearch=false, derefAliases=null, followReferrals=false, searchEntryHandlers=null]|<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">org.ldaptive.LdapException: javax.naming.NoPermissionException: [LDAP: error code 50 - Operations are restricted to bind/unbind/abandon/StartTLS/modify password];
remaining name 'uid=xxxxxx,ou=people,dc=umt,dc=edu'<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> at org.ldaptive.provider.ProviderUtils.throwOperationException(ProviderUtils.java:77)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Caused by: javax.naming.NoPermissionException: [LDAP: error code 50 - Operations are restricted to bind/unbind/abandon/StartTLS/modify password]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"> at com.sun.jndi.ldap.LdapCtx.mapErrorCode(LdapCtx.java:3144)<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">2016-12-12 13:13:23,118 - INFO [org.ldaptive.auth.Authenticator:282] - Authentication succeeded for dn: uid=xxxxxx,ou=people,dc=umt,dc=edu<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">2016-12-12 13:13:23,119 - DEBUG [org.ldaptive.auth.Authenticator:307] - authenticate response=[org.ldaptive.auth.AuthenticationHandlerResponse@1901772651::connection=[org.ldaptive.DefaultConnectionFactory$DefaultConnection@260634741::config=[org.ldaptive.ConnectionConfig@1845349421::ldapUrl=ldaps://example.umt.edu:636,
connectTimeout=3000, responseTimeout=-1, sslConfig=[org.ldaptive.ssl.SslConfig@1214272534::credentialConfig=net.shibboleth.idp.authn.impl.KeystoreResourceCredentialConfig@4ca1c64e, trustManagers=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=null],
useSSL=true, useStartTLS=false, connectionInitializer=null], providerConnectionFactory=[org.ldaptive.provider.jndi.JndiConnectionFactory@2131097089::metadata=[ldapUrl=ldaps://example.umt.edu:636, count=1], environment={java.naming.ldap.factory.socket=org.ldaptive.ssl.ThreadLocalTLSSocketFactory,
com.sun.jndi.ldap.connect.timeout=3000, java.naming.ldap.version=3, java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory, java.naming.security.protocol=ssl}, providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig@1203609377::operationExceptionResultCodes=[PROTOCOL_ERROR,
SERVER_DOWN], properties={}, connectionStrategy=org.ldaptive.provider.ConnectionStrategies$DefaultConnectionStrategy@324998f5, controlProcessor=org.ldaptive.provider.ControlProcessor@29e255d9, environment=null, tracePackets=null, removeDnUrls=true, searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED,
SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocketFactory=null, hostnameVerifier=null]], providerConnection=org.ldaptive.provider.jndi.JndiConnection@3b08d257], result=true, resultCode=SUCCESS, message=null, controls=[[org.ldaptive.control.PasswordPolicyControl@159938469::criticality=false,
timeBeforeExpiration=0, graceAuthNsRemaining=0, error=CHANGE_AFTER_RESET]]] for dn=uid=jo180287,ou=people,dc=umt,dc=edu with request=[org.ldaptive.auth.AuthenticationRequest@850478646::user=[org.ldaptive.auth.User@1890173199::identifier=jo180287, context=org.apache.velocity.VelocityContext@3d31c60f],
retAttrs=[umid]]|10.10.18.162<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">2016-12-12 13:13:23,119 - TRACE [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:150] - Profile Action ValidateUsernamePasswordAgainstLDAP:
Authentication response [org.ldaptive.auth.AuthenticationResponse@1819759401::authenticationResultCode=AUTHENTICATION_HANDLER_SUCCESS, ldapEntry=[dn=uid=xxxxxx,ou=people,dc=umt,dc=edu[]], accountState=[org.ldaptive.auth.ext.PasswordPolicyAccountState@481145515::accountWarnings=null,
accountErrors=[CHANGE_AFTER_RESET]], result=true, resultCode=SUCCESS, message=null, controls=[[org.ldaptive.control.PasswordPolicyControl@159938469::criticality=false, timeBeforeExpiration=0, graceAuthNsRemaining=0, error=CHANGE_AFTER_RESET]]]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">2016-12-12 13:13:23,120 - INFO [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:152] - Profile Action ValidateUsernamePasswordAgainstLDAP: Login
by 'xxxxxx' succeeded<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Josh<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> users [mailto:users-bounces@shibboleth.net]
<b>On Behalf Of </b>Daniel Fisher<br>
<b>Sent:</b> Monday, December 12, 2016 12:52 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: OpenLDAP Password Policy account state handling.<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<div>
<p class="MsoNormal">On Mon, Dec 12, 2016 at 12:41 PM, O'Dowd, Josh <<a href="mailto:Josh.O'Dowd@mso.umt.edu" target="_blank">Josh.O'Dowd@mso.umt.edu</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">So that is another problem in itself, I think… that the return attributes are not fetched when there
is an accountError within the account state.</span><o:p></o:p></p>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Can you check your LDAP logs to confirm this? You should see the search for the umid attribute immediately after the bind. If you don't have access to the LDAP logs, you can also put the org.ldaptive package in DEBUG.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">--Daniel Fisher<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</div>
</div>
</body>
</html>