<div dir="ltr"><div dir="ltr"><div class="gmail_default" style="font-family:verdana,sans-serif"><span style="font-family:Arial,Helvetica,sans-serif">On Mon, Aug 29, 2022 at 7:57 PM Lipscomb, Gary <<a href="mailto:glipscomb@csu.edu.au">glipscomb@csu.edu.au</a>> wrote:</span><br></div></div><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="msg-857720195515524079">





<div lang="EN-AU" style="overflow-wrap: break-word;">
<div class="m_-857720195515524079WordSection1">
<p class="MsoNormal"><span>Hi Dan,<u></u><u></u></span></p>
<p class="MsoNormal"><span><u></u> <u></u></span></p>
<p class="MsoNormal"><span>I finally got it working yesterday by doing the following<u></u><u></u></span></p>
<ul style="margin-top:0cm" type="disc">
<li class="m_-857720195515524079MsoListParagraph" style="margin-left:0cm"><span>In openLDAP  in the password policy set pwdMustChange: TRUE<u></u><u></u></span></li><li class="m_-857720195515524079MsoListParagraph" style="margin-left:0cm"><span>In openLDAP  in the user account set pwdReset: TRUE<u></u><u></u></span></li><li class="m_-857720195515524079MsoListParagraph" style="margin-left:0cm"><span>In the IdP in password-authn-config.xml add CHANGE_AFTER_RESET<u></u><u></u></span>
<ul style="margin-top:0cm" type="circle">
<li class="m_-857720195515524079MsoListParagraph" style="margin-left:0cm"><span>        <entry key="ExpiringPassword"><u></u><u></u></span></li><li class="m_-857720195515524079MsoListParagraph" style="margin-left:0cm"><span>            <list><u></u><u></u></span></li><li class="m_-857720195515524079MsoListParagraph" style="margin-left:0cm"><span>                <value>ACCOUNT_WARNING</value><u></u><u></u></span></li><li class="m_-857720195515524079MsoListParagraph" style="margin-left:0cm"><span>                <value>CHANGE_AFTER_RESET</value>
<u></u><u></u></span></li><li class="m_-857720195515524079MsoListParagraph" style="margin-left:0cm"><span>       </list><u></u><u></u></span></li></ul>
</li></ul>
<p class="MsoNormal"><span>This will then give the user the “Your password will be expiring soon<b>.
</b></span><strong><span style="font-family:Calibri,sans-serif;font-weight:normal">Please ensure you update your password via the Staff Portal before it expires”</span></strong></p></div></div></div></blockquote><div><br></div>Ok, I think this makes sense. CHANGE_AFTER_RESET would only be returned on a successful authentication, so only the warning flow could execute. Sounds like you're on the right track to forcing a password change and leveraging CHANGE_AFTER_RESET doesn't provide much, if any, value.<br><br><div>--Daniel Fisher</div><div> </div></div></div>