<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0cm;
margin-right:0cm;
margin-bottom:0cm;
margin-left:36.0pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;
mso-fareast-language:EN-US;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:1663964722;
mso-list-type:hybrid;
mso-list-template-ids:-1660511322 201916417 201916419 201916421 201916417 201916419 201916421 201916417 201916419 201916421;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:54.0pt;
text-indent:-18.0pt;
font-family:Symbol;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:90.0pt;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:126.0pt;
text-indent:-18.0pt;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:162.0pt;
text-indent:-18.0pt;
font-family:Symbol;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:198.0pt;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:234.0pt;
text-indent:-18.0pt;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:270.0pt;
text-indent:-18.0pt;
font-family:Symbol;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:306.0pt;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
margin-left:342.0pt;
text-indent:-18.0pt;
font-family:Wingdings;}
@list l1
{mso-list-id:1778989541;
mso-list-type:hybrid;
mso-list-template-ids:-1792654534 201916417 201916419 201916421 201916417 201916419 201916421 201916417 201916419 201916421;}
@list l1:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Symbol;}
@list l1:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l1:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
@list l1:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Symbol;}
@list l1:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l1:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
@list l1:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Symbol;}
@list l1:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l1:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
@list l2
{mso-list-id:1797218185;
mso-list-type:hybrid;
mso-list-template-ids:-1804826082 201916417 201916419 201916421 201916417 201916419 201916421 201916417 201916419 201916421;}
@list l2:level1
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Symbol;}
@list l2:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l2:level3
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
@list l2:level4
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Symbol;}
@list l2:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l2:level6
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
@list l2:level7
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Symbol;}
@list l2:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:"Courier New";}
@list l2:level9
{mso-level-number-format:bullet;
mso-level-text:;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-18.0pt;
font-family:Wingdings;}
ol
{margin-bottom:0cm;}
ul
{margin-bottom:0cm;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-AU" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Hi Dan,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">I finally got it working yesterday by doing the following<o:p></o:p></span></p>
<ul style="margin-top:0cm" type="disc">
<li class="MsoListParagraph" style="margin-left:0cm;mso-list:l1 level1 lfo1"><span style="mso-fareast-language:EN-US">In openLDAP in the password policy set pwdMustChange: TRUE<o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:0cm;mso-list:l1 level1 lfo1"><span style="mso-fareast-language:EN-US">In openLDAP in the user account set pwdReset: TRUE<o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:0cm;mso-list:l1 level1 lfo1"><span style="mso-fareast-language:EN-US">In the IdP in password-authn-config.xml add CHANGE_AFTER_RESET<o:p></o:p></span>
<ul style="margin-top:0cm" type="circle">
<li class="MsoListParagraph" style="margin-left:0cm;mso-list:l1 level2 lfo1"><span style="mso-fareast-language:EN-US"> <entry key="ExpiringPassword"><o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:0cm;mso-list:l1 level2 lfo1"><span style="mso-fareast-language:EN-US"> <list><o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:0cm;mso-list:l1 level2 lfo1"><span style="mso-fareast-language:EN-US"> <value>ACCOUNT_WARNING</value><o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:0cm;mso-list:l1 level2 lfo1"><span style="mso-fareast-language:EN-US"> <value>CHANGE_AFTER_RESET</value>
<o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:0cm;mso-list:l1 level2 lfo1"><span style="mso-fareast-language:EN-US"> </list><o:p></o:p></span></li></ul>
</li></ul>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">This will then give the user the “Your password will be expiring soon<b>.
</b></span><strong><span style="font-family:"Calibri",sans-serif;font-weight:normal">Please ensure you update your password via the Staff Portal before it expires”<o:p></o:p></span></strong></p>
<p class="MsoNormal"><strong><span style="font-family:"Calibri",sans-serif;font-weight:normal">I was trying to add the pwdMustChange: TRUE to the user record. This had no effect.<o:p></o:p></span></strong></p>
<p class="MsoNormal"><strong><span style="font-family:"Calibri",sans-serif;font-weight:normal"><o:p> </o:p></span></strong></p>
<p class="MsoNormal"><strong><span style="font-family:"Calibri",sans-serif;font-weight:normal">If I add CHANGE_AFTER_RESET to the “ExpiredPassword” entry<o:p></o:p></span></strong></p>
<ul style="margin-top:0cm" type="disc">
<li class="MsoListParagraph" style="margin-left:18.0pt;mso-list:l0 level1 lfo2"><span style="mso-fareast-language:EN-US"> <entry key="ExpiredPassword"><o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:18.0pt;mso-list:l0 level1 lfo2"><span style="mso-fareast-language:EN-US"> <list><o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:18.0pt;mso-list:l0 level1 lfo2"><span style="mso-fareast-language:EN-US"> <value>PASSWORD_EXPIRED</value><o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:18.0pt;mso-list:l0 level1 lfo2"><span style="mso-fareast-language:EN-US"> <value>CLIENT KEY EXPIRED</value><o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:18.0pt;mso-list:l0 level1 lfo2"><span style="mso-fareast-language:EN-US"> <value>AcceptSecurityContext error, data 532</value><o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:18.0pt;mso-list:l0 level1 lfo2"><span style="mso-fareast-language:EN-US"> <value>AcceptSecurityContext error, data 773</value><o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:18.0pt;mso-list:l0 level1 lfo2"><span style="mso-fareast-language:EN-US"> <value>AcceptSecurityContext error, data 701</value><o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:18.0pt;mso-list:l0 level1 lfo2"><span style="mso-fareast-language:EN-US"> <value>CHANGE_AFTER_RESET</value>
<o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:18.0pt;mso-list:l0 level1 lfo2"><span style="mso-fareast-language:EN-US"> </list><o:p></o:p></span></li><li class="MsoListParagraph" style="margin-left:18.0pt;mso-list:l0 level1 lfo2"><span style="mso-fareast-language:EN-US"> </entry><o:p></o:p></span></li></ul>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">the login process won’t proceed past the login page but NO “Expired Password” message is displayed. I didn’t investigate any further with this.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Since the expiring password method can’t force a user to change their password we are looking at an alternative when the password has been administratively reset for the user and we tell them they
must change it within 24 hours.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">What appears to be working is that in openLDAP we change the users Password Policy to one that has an expiry time of 1 day by<o:p></o:p></span></p>
<ul style="margin-top:0cm" type="disc">
<li class="MsoListParagraph" style="margin-left:0cm;mso-list:l2 level1 lfo3"><span style="mso-fareast-language:EN-US">Setting pwdPolicySubentry: cn=PasswordPolicyReset,ou=Policies,o=example.com<o:p></o:p></span></li></ul>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">This gives the expiring password message and then the expired password message if they don’t change it within 24 hours without having to make any changes to Shibboleth.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Thanks for pointing me in the right direction.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">We haven’t made a final decision on which option to follow.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Regards<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US">Gary<o:p></o:p></span></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Arial",sans-serif;color:#DA3D0F;mso-fareast-language:EN-US">Gary Lipscomb<o:p></o:p></span></b></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif">Technical Officer, Systems
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:9.0pt;font-family:"Arial",sans-serif">IT
<span style="color:#414141">Infrastructure & Security | Division of Information Technology</span></span><o:p></o:p></p>
<p class="MsoNormal"><span style="mso-fareast-language:EN-US"><o:p> </o:p></span></p>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm">
<p class="MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> Daniel Fisher <dfisher@vt.edu>
<br>
<b>Sent:</b> Tuesday, 30 August 2022 09:27<br>
<b>To:</b> Lipscomb, Gary <glipscomb@csu.edu.au><br>
<b>Subject:</b> Re: openLDAP pwdReset pwdMustChange<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">On Wed, Aug 24, 2022 at 2:27 PM Daniel Fisher <<a href="mailto:dfisher@vt.edu">dfisher@vt.edu</a>> wrote:</span><span style="font-family:"Verdana",sans-serif"><o:p></o:p></span></p>
</div>
</div>
<div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<div>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">On Wed, Aug 24, 2022 at 12:34 AM Lipscomb, Gary via users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>> wrote:</span><span style="font-family:"Verdana",sans-serif"><o:p></o:p></span></p>
</div>
</div>
<div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0cm 0cm 0cm 6.0pt;margin-left:4.8pt;margin-right:0cm">
<div>
<div>
<div>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">Thanks Dan,<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto"> <o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">We already have that set and password expiration works. We get a warning displayed from 10 days prior to password expiration.<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">It’s just adding the additional pwdReset and pwdMustChange don’t do anything using SSO but work with ldapsearch CLI.<o:p></o:p></p>
</div>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif">Try adding CHANGE_AFTER_RESET to the ExpiredPassword entry of shibboleth.authn.Password.ClassifiedMessageMap.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif">(Assuming you want to treat this condition as an expired password.)<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif">I *think* that will fire an expired password warning event, but it's not something I've tried before.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif">--Daniel Fisher<o:p></o:p></span></p>
</div>
</div>
</div>
</blockquote>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif">Please let me know if this works for you. If so, I'll make sure this gets committed to the project for the next release. Thanks.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-family:"Verdana",sans-serif"><o:p> </o:p></span></p>
</div>
<div>
<div>
<div>
<p class="MsoNormal">--Daniel Fisher<o:p></o:p></p>
</div>
</div>
</div>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
</div>
</div>
</div>
</body>
</html>