<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Aptos;
panose-1:2 11 0 4 2 2 2 2 2 4;}
@font-face
{font-family:"Times New Roman \(Body CS\)";
panose-1:2 11 6 4 2 2 2 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:10.0pt;
font-family:"Aptos",sans-serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Verdana",sans-serif;
color:windowtext;
font-weight:normal;
font-style:normal;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Verdana",sans-serif"><o:p> </o:p></span></p>
<div id="mail-editor-reference-message-container">
<div>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="mso-margin-top-alt:0in;margin-right:0in;margin-bottom:12.0pt;margin-left:.5in">
<b><span style="font-size:12.0pt;color:black">From: </span></b><span style="font-size:12.0pt;color:black">users <users-bounces@shibboleth.net> on behalf of IAM David Bantz via users <users@shibboleth.net><br>
<b>Date: </b>Tuesday, May 6, 2025 at 7:35</span><span style="font-size:12.0pt;font-family:"Arial",sans-serif;color:black"> </span><span style="font-size:12.0pt;color:black">PM<br>
<b>To: </b>Shib Users <users@shibboleth.net><br>
<b>Cc: </b>IAM David Bantz <dabantz@alaska.edu><br>
<b>Subject: </b>Re: LDAP allow authentication for "account expired" error codes<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="margin-left:.5in"><span style="font-size:12.0pt">We get that the normal flow is the AD bind attempt fails if the account is expired with the generic "49" bind failed and data code 701 indicating that while the user account / password
combination is correct but the account is expired.<br>
<br>
For local historical reasons, a few key services want to allow such accounts to access in that scenario. Accounts for former students and employees expire, but are entitled to a small subset of services. We do have a means of doing so with our IdP - a proxy
in front of the LDAP (AD) that intercepts the message (error 49, data code 701) and re-writes that to a "success" response to the IdP. That proxy service is configured as a failover (4th in line after "normal" AD instances fail to authenticate the user) has
too often been a point of failure; I was hoping we could get the Shibb IdP to fulfill that purpose more reliably. <br>
<br>
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Verdana",sans-serif">If you could file an issue I’ll take a look at the scope of work to support this functionality. In general, it would require a custom authentication handler to change the bind
failure to a success when certain data codes are encountered. That’s not a component that currently exists, but if it’s useful to the AD community, it can be added.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Verdana",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Verdana",sans-serif">--Daniel Fisher<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Verdana",sans-serif"><o:p> </o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</body>
</html>