<div dir="ltr">We are running idp_version: 4.2.1 and jdk_version: 11.0.17 and it still works as expected. I am sure we might need to update this at some point as I also thought it was going to be deprecated.</div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Jan 6, 2023 at 10:48 AM David Alexander via users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div>Thanks for sharing this example.</div><div><br></div>Does the "org.joda.time.format.DateTimeFormat" reference work in expiring-password-intercept-config.xml in Shib 4.1.x?<br><div><br></div><div>I thought that was deprecated a while back.</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Jan 6, 2023 at 10:11 AM Lee Foltz via users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr">We did this using epoch time from LDAP password last change date, but used this setup to intercept the users when their password is about to expire. <div>We display the intercept to people if the password is over 3 years old, then show them the intercept every 24 hours to remind them to change password.</div><div><br></div><div>Hopefully this example will help some.<br><div><br></div><div>attribute-resolver.xml<br><br> <AttributeDefinition id="passwordExpiration" xsi:type="ScriptedAttribute" ><br> <InputDataConnector ref="myLDAP" attributeNames="shadowLastChange" /><br> <Script><br> <![CDATA[<br> logger = Java.type("org.slf4j.LoggerFactory").getLogger("net.shibboleth.idp");<br><br> // get epoch last changed and convert from days to milliseconds<br> <a href="http://logger.info" target="_blank">logger.info</a>("--- shadowLastChange: {}", shadowLastChange.getValues().get(0));<br> String = Java.type("java.lang.String");<br> Long = Java.type("java.lang.Long");<br> pwls = new Long(shadowLastChange.getValues().get(0));<br> pwls = pwls * 24 * 3600 * 1000;<br><br> // convert to Java date<br> Date = Java.type("java.util.Date");<br> expireDate = new Date(pwls);<br><br> // convert to format to match the expiring password intercept config<br> SimpleDateFormat = Java.type("java.text.SimpleDateFormat");<br> passwordExpiration.addValue(new SimpleDateFormat("yyyyMMdd").format(expireDate));<br> <a href="http://logger.info" target="_blank">logger.info</a>("--- shadowLastChange Converted: {}", new SimpleDateFormat("yyyyMMdd").format(expireDate));<br> ]]><br> </Script><br><br><br><br>expiring-password-intercept-config.xml<br><br> <bean id="shibboleth.expiring-password.Condition" class="net.shibboleth.idp.profile.logic.DateAttributePredicate"<br> c:attribute="passwordExpiration" p:resultIfMissing="true"><br> <constructor-arg name="formatter"><br> <bean class="org.joda.time.format.DateTimeFormat" factory-method="forPattern" c:_0="yyyyMMdd" /><br> </constructor-arg><br> <property name="systemTimeOffset"><br> <bean class="org.joda.time.Duration" factory-method="standardDays" c:_0="1095" /><br> </property><br> </bean><br><br> <!-- Name of cookie to track when user was last notified. --><br> <bean id="shibboleth.expiring-password.NotifyCookieName" class="java.lang.String" c:_0="shib_idp_exp_pwd" /><br><br> <!-- Interval (milliseconds) between notifications, default is 8 hours. We changed this to 4 hours --><br> <bean id="shibboleth.expiring-password.NotifyInterval" class="java.lang.Long" c:_0="14400000" /><br></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Jan 6, 2023 at 9:59 AM Cantor, Scott via users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">> Would the offset be positive if I use the password last changed date?<br>
<br>
Probably positive "minus the amount of time you want to warn" or something like that. Needless to say it hurts my brain every time I go near it so once it works I leave it alone. But I think you're probably right.<br>
<br>
I'm just saying it's math, and two operations can always be combined into one, you just have to figure out what the combination of the two is.<br>
<br>
-- Scott<br>
<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" rel="noreferrer" target="_blank">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr"><div dir="ltr"><div><div>Lee Foltz</div><div>Oakland University - UTS</div><div>Senior Identity and Access Management Engineer</div><div> </div><div>248-370-2675</div></div></div></div>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" rel="noreferrer" target="_blank">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" rel="noreferrer" target="_blank">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature"><div dir="ltr"><div><div>Lee Foltz</div><div>Oakland University - UTS</div><div>Senior Identity and Access Management Engineer</div><div> </div><div>248-370-2675</div></div></div></div>