<div dir="ltr"><div dir="ltr"><div class="gmail_default" style="font-family:verdana,sans-serif"><span style="font-family:Arial,Helvetica,sans-serif">On Tue, Aug 23, 2022 at 1:31 AM Lipscomb, Gary via users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>> wrote:</span><br></div></div><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="msg6237510340882025978">





<div lang="EN-AU" style="overflow-wrap: break-word;">
<div class="gmail-m_6237510340882025978WordSection1">
<p class="MsoNormal">Has anyone done this?<br></p></div></div></div></blockquote><div><br></div><div><div class="gmail_default" style="font-family:verdana,sans-serif">It appears you're attempting to use <a href="https://datatracker.ietf.org/doc/html/draft-behera-ldap-password-policy-10">https://datatracker.ietf.org/doc/html/draft-behera-ldap-password-policy-10</a> for your password policy implementation.</div><div class="gmail_default" style="font-family:verdana,sans-serif"><span style="font-family:Arial,Helvetica,sans-serif"> </span></div></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="msg6237510340882025978"><div lang="EN-AU" style="overflow-wrap: break-word;"><div class="gmail-m_6237510340882025978WordSection1"><p class="MsoNormal"><u></u></p>
<ul style="margin-top:0cm" type="disc"><li class="gmail-m_6237510340882025978MsoListParagraph" style="margin-left:0cm">idp.authn.LDAP.usePasswordPolicy = true</li></ul></div></div></div></blockquote><div><br></div><div><div class="gmail_default" style="font-family:verdana,sans-serif">This is the property you want set to true to enable this feature.</div></div><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="msg6237510340882025978"><div lang="EN-AU" style="overflow-wrap: break-word;"><div class="gmail-m_6237510340882025978WordSection1"><ul style="margin-top:0cm" type="disc"><li class="gmail-m_6237510340882025978MsoListParagraph" style="margin-left:0cm">idp.authn.LDAP.usePasswordExpiration = true<u></u></li></ul></div></div></div></blockquote><div><br></div><div><div class="gmail_default" style="font-family:verdana,sans-serif">This property enables a different type of password policy implementation (<a href="http://tools.ietf.org/html/draft-vchu-ldap-pwd-policy-00">http://tools.ietf.org/html/draft-vchu-ldap-pwd-policy-00</a>)</div><div class="gmail_default" style="font-family:verdana,sans-serif">Set it to false.</div></div><div><br></div><div><div class="gmail_default" style="font-family:verdana,sans-serif">Assuming you've configured the ppolicy overlay correctly in OpenLDAP....</div><div class="gmail_default" style="font-family:verdana,sans-serif">Your IDP should signal a warning type of AuthnEventIds.ACCOUNT_WARNING when a password warning is returned from an LDAP authentication. And an error type of AuthnEventIds.ACCOUNT_ERROR when a password error is returned.</div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div><div class="gmail_default" style="font-family:verdana,sans-serif">--Daniel Fisher</div><div class="gmail_default" style="font-family:verdana,sans-serif"><br></div></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="msg6237510340882025978">
</div></blockquote></div></div>