<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
After setting up some tests and cranking up the logging, I found that all I needed to do was set
<font size="2"><span style="font-size:11pt">idp.authn.LDAP.usePasswordPolicy=true</span></font>. This flag adds the PasswordPolicyAuthenticationRequestHandler() and PasswordPolicyAuthenticationResponseHandler() handlers to the Authenticator. I didn't need
to modify beans to add the handlers.</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I'm using ODSEE, and it doesn't provide any static attributes that I can query for the password expiration time, etc, so the password policy control is the only way.</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks,</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Andy<br>
</div>
<div>
<div id="appendonsend"></div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Cantor, Scott <cantor.2@osu.edu><br>
<b>Sent:</b> Thursday, February 11, 2021 3:02 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: IDPv4 LDAP account state</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="PlainText">[This email originated from outside of OSU. Use caution with links and attachments.]<br>
<br>
On 2/11/21, 5:51 PM, "users on behalf of Andrew Jason Morgan" <users-bounces@shibboleth.net on behalf of morgan@oregonstate.edu> wrote:<br>
<br>
> Can I simply set idp.authn.LDAP.usePasswordPolicy=true<br>
<br>
Theoretically but no idea if it works, I guess it seems to have not worked for some. For expiring password warnings only, I just urge using the interceptor flow instead and reading the expiration out of the directory where possible.<br>
<br>
-- Scott<br>
<br>
<br>
--<br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font></div>
</div>
</body>
</html>