<div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div>Thank you Daniel and Scott.</div><div><br></div><div>I have inserted into 'ldap-authn-config.xml' and 'password-authn-config.xml' the entries below --- however, still receiving '<span class="gmail-login_error">Login Failure:
javax.naming.OperationNotSupportedException: [LDAP: error code 53 -
Account inactivated. Contact system administrator.]</span>
' messaging --- the logs are at end of email. Have I missed anything -- it would seem resultCode is '<b>UNWILLING_TO_PERFORM</b>' --- and that would trigger the 'AccountLocked' flow.<br></div><div><br></div><div>ldap-authn-config.xml<br></div><div><bean id="authenticationResponseHandler" class="org.ldaptive.auth.ext.FreeIPAAuthenticationResponseHandler" ><br> <constructor-arg value="0" /><br> <constructor-arg value="0" /><br> <constructor-arg value="0" /><br> </bean></div><div><br></div><div>password-authn-config.xml<br></div><div><entry key="AccountLocked"><br> <list><br> <value>AccountLocked</value><br> <value>UNWILLING_TO_PERFORM</value><br> <value>UNAVAILABLE_CRITICAL_EXTENSION</value><br> <value>ACCOUNT_DISABLED</value><br> <value>Clients credentials have been revoked</value><br> </list><br> </entry><br></div><div><br></div><div>2018-11-06 12:11:28,137 - DEBUG [org.ldaptive.auth.PooledBindAuthenticationHandler:86] - [BDFE57022A7C35D88ADBDBD0A094E5D2] - [127.0.0.1] - authenticate response=[org.ldaptive.auth.AuthenticationHandlerResponse@5467434::connection=[org.ldaptive.DefaultConnectionFactory$DefaultConnection@209642554::config=[org.ldaptive.ConnectionConfig@16737856::ldapUrl=ldaps://<a href="http://example.com">example.com</a> , connectTimeout=10000, responseTimeout=10000, sslConfig=[org.ldaptive.ssl.SslConfig@1145576216::credentialConfig=null, trustManagers=null, hostnameVerifier=null, hostnameVerifierConfig=null, enabledCipherSuites=null, enabledProtocols=null, handshakeCompletedListeners=null], useSSL=false, useStartTLS=false, connectionInitializer=null], providerConnectionFactory=[org.ldaptive.provider.jndi.JndiConnectionFactory@1669487719::metadata=[ldapUrl=ldaps://<a href="http://example.com">example.com</a>, count=1], environment={java.naming.ldap.factory.socket=org.ldaptive.ssl.ThreadLocalTLSSocketFactory, com.sun.jndi.ldap.connect.timeout=10000, java.naming.ldap.version=3, java.naming.factory.initial=com.sun.jndi.ldap.LdapCtxFactory, com.sun.jndi.ldap.read.timeout=10000}, providerConfig=[org.ldaptive.provider.jndi.JndiProviderConfig@1413643593::operationExceptionResultCodes=[PROTOCOL_ERROR, SERVER_DOWN], properties={}, connectionStrategy=org.ldaptive.provider.ConnectionStrategies$DefaultConnectionStrategy@69ddedf6, controlProcessor=org.ldaptive.provider.ControlProcessor@3101afb8, environment=null, tracePackets=null, removeDnUrls=true, searchIgnoreResultCodes=[TIME_LIMIT_EXCEEDED, SIZE_LIMIT_EXCEEDED, PARTIAL_RESULTS], sslSocketFactory=null, hostnameVerifier=null]], providerConnection=org.ldaptive.provider.jndi.JndiConnection@2e7f7327], result=false, resultCode=<b>UNWILLING_TO_PERFORM</b>, message=javax.naming.OperationNotSupportedException: [LDAP: error code 53 - Account inactivated. Contact system administrator.], controls=null] for criteria=[org.ldaptive.auth.AuthenticationCriteria@1465948621::dn=uid=lisa,dc=example,dc=com, authenticationRequest=[org.ldaptive.auth.AuthenticationRequest@850653990::user=[org.ldaptive.auth.User@1673580225::identifier=lisa, context=org.apache.velocity.VelocityContext@63271a4], retAttrs=[1.1], controls=null]]<br></div></div></div></div></div><br><div class="gmail_quote"><div dir="ltr">On Mon, Nov 5, 2018 at 8:26 PM Daniel Fisher <<a href="mailto:dfisher@vt.edu">dfisher@vt.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div class="gmail_quote"><div dir="ltr">On Mon, Nov 5, 2018 at 4:26 PM Lille M <<a href="mailto:lillemacdoe@gmail.com" target="_blank">lillemacdoe@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr">org.ldaptive.LdapException: javax.naming.OperationNotSupportedException: [LDAP: error code 53 - Account inactivated. Contact system administrator.]<br></div><div dir="ltr"> at net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP.doExecute(ValidateUsernamePasswordAgainstLDAP.java:187)</div></div></div></div></blockquote><div><br></div><div>You need to configure a response handler to produce an account state.</div><div>Ldaptive doesn't ship with one specific to 389 directory server, but it does have one for FreeIPA which I believe is based on 389.</div><div>Add to ldap-authn-config.xml:</div><div><bean id="authenticationResponseHandler" class="org.ldaptive.auth.ext.FreeIPAAuthenticationResponseHandler" ></div><div><constructor-arg value="0" /><constructor-arg value="0" /><constructor-arg value="0" /></bean></div><div><br></div><div>(I left the constructor args at zero assuming you're not interested in configuring account states for successful authentication.)</div><div>If the response handler works you should be able to match on ACCOUNT_DISABLED.</div><div><br></div><div>--Daniel Fisher</div><div><br></div></div></div></div></div></div>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a></blockquote></div>