<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">On Wed, Dec 14, 2016 at 6:23 PM, O'Dowd, Josh <span dir="ltr"><<a href="mailto:Josh.O'Dowd@mso.umt.edu" target="_blank">Josh.O'Dowd@mso.umt.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><br>The snippets each begin from the trace entry which includes the ldaptive authenticationResponse details.  Daniel, can you confirm that you are seeing the same location of the CHANGE_AFTER_RESET in your ldaptiveResponse, where the code is an accountStateError?  Thanks.<br></blockquote><div><br></div><div>From my logs:</div><div>TRACE [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:150] - Profile Action ValidateUsernamePasswordAgainstLDAP: Authentication response [org.ldaptive.auth.AuthenticationResponse@1871242805::authenticationResultCode=AUTHENTICATION_HANDLER_SUCESS, ldapEntry=[XXXXXX, responseControls=null, messageId=-1], accountState=[org.ldaptive.auth.ext.PasswordPolicyAccountState@1236509355::accountWarnings=null, accountErrors=[CHANGE_AFTER_RESET]], result=true, resultCode=SUCCESS, message=null, controls=null]<br></div><div><br></div><div>I faked the account state, you can see the ppolicy control is absent.</div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><br>
*************************** Begin CHANGE_AFTER_RESET authn/Password flow snippet ***************<br>2016-12-14 13:49:35,845 - DEBUG [org.springframework.webflow.<wbr>execution.ActionExecutor:53] - Finished executing net.shibboleth.idp.authn.impl.<wbr>ValidateUsernamePasswordAgains<wbr>tLDAP@461513a1; result = success</blockquote><div><br></div><div>I'm not sure how you got that result. From my logs:</div><div>DEBUG [org.springframework.webflow.execution.ActionExecutor:53] - Finished executing net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP@4a0159d5; result = ExpiredPassword<br></div><div><br></div><div>Can you do a fresh install and then a recursive diff to confirm you haven't accidentally changed something.</div><div>Thanks.<br></div><div><br></div><div>--Daniel Fisher</div><div><br></div></div></div></div>