Hi André,
I don't see another way to do that pdadmin login call. Indeed, you must take care of performance. On the other hand, that call only needs to be done when the user fails to authenticate. So should not be too often...
Now, can you also try the following: use the init() of the ULH with the whole range of params? The below is taken from the JavaDoc:
init(java.lang.String hostname, int port, java.lang.String bindDn, java.lang.String bindDnPwd, java.lang.String keystore, java.lang.String clientCertLabel, java.lang.String searchFilter, java.lang.String mgmtDomain, int connectionTimeout, boolean loginFailuresPersistent, java.util.Properties overrideProperties) So use the user's credentials for the BindDn and bindDnPwd. If you're lucky, then you might get an error code that discern between expired and wrong. You should do this init() only after you've detected a failed authentication of course.
Let me know if this is a good idea and if it helps.
As for an example of calling the REST API from within an InfoMap you can look at the git repo where I pointed to earlier in this thread. It has examples on how to call OAuth API calls.
Kind regards, Peter.
------------------------------
Peter Volckaert
Senior Sales Engineer
Authentication and Access
IBM Security
------------------------------
Original Message:
Sent: Thu September 24, 2020 09:51 AM
From: André Leruitte
Subject: How to detect when an ActiveDirectory account has been flagged for mandatory password change ?
Hi Peter,
Before looking into how implementing a pdadmin call from within a "mapping rule" I tested via CLI:
------------------------------
André Leruitte
Original Message:
Sent: Thu September 24, 2020 05:07 AM
From: Peter Volckaert
Subject: How to detect when an ActiveDirectory account has been flagged for mandatory password change ?
Hi André,
What happens if you do a pdadmin login command for that user?
If it says "expired", then you can use the pdadmin API to do the same check from within your Infomap.
That REST API is called "Running pdadmin commands" and can be found as in the screenshot below. Click on the picture to actually see something :-)
I'm curious to know if this helps.
Kind regards, Peter.
------------------------------
Peter Volckaert
Senior Sales Engineer
Authentication and Access
IBM Security
Original Message:
Sent: Thu September 24, 2020 04:38 AM
From: André Leruitte
Subject: How to detect when an ActiveDirectory account has been flagged for mandatory password change ?
Hi Peter,
Thanks for your advice. Unfortunately it doesn't allow to discern between the following cases :
- login with a valid userid / incorrect password
- login with a valid userid / expired password
I know there is some way to do it because ISVA implements it when using /pkmslogin . It returns a "HPDIA0204W The user's password has expired" error.
How could I implement the same inside an authentication policy? Does somebody have another idea?
------------------------------
André Leruitte
Original Message:
Sent: Thu September 24, 2020 02:58 AM
From: Peter Volckaert
Subject: How to detect when an ActiveDirectory account has been flagged for mandatory password change ?
Hi André,
Take a look here: https://github.com/peter-volckaert/custom-password/blob/master/mapping-rules/Infomap_CustomPassword.js
In that Infomap I print out some things you can discover about the status of the credential.
Here's the snippet:
logmsg(INFO,"isAccountValid="+user.isAccountValid()+",isAccountLocked="+user.isAccountLocked()+",isAccountDisabled="+user.isAccountDisabled()); logmsg(INFO,"isPasswordValid="+user.isPasswordValid()+",isCredentialsValid="+user.isCredentialsValid()+",isPasswordExpiringSoon="+user.isPasswordExpiringSoon());
I'd suggest you embed similar logging in your code and see if anyone of those work for your use case.
What's available is documented (indeed lightly...) in the User class of the JavaDoc.
Kind regards, Peter.
------------------------------
Peter Volckaert
Senior Sales Engineer
Authentication and Access
IBM Security
Original Message:
Sent: Wed September 23, 2020 05:13 AM
From: André Leruitte
Subject: How to detect when an ActiveDirectory account has been flagged for mandatory password change ?
Hello,
We have an authentication policy that is responsible for checking login/password against our Active Directory, and handling some throttling.
I am trying to tweak the process for some edge cases as when an AD account is flagged for mandatory password change on login.
I haven't found any way at the moment to detect that precise case.
Here is how we do the AD authentication in the auth policy:
var hlpr = new UserLookupHelper();hlpr.init(true); // Init with "Username / Password" auth mechanismvar user = hlpr.getUser(username);if (user != null) { var authn = user.authenticate(password); if (authn) { // do what's needed for populating ISAM creds } else { //log an error and handle throttling // TODO detect if account is flagged for mandatory password change }}
The documentation on the class com.ibm.security.access.user.User is very light, and most of the available properties are not documented.
Anyway I tried a few of those properties (such as isPasswordValid()) but I haven't found any property allowing me to identify precisely the edge case I am looking for.
Has someone handled this particular case ? How could we implemented a detection for this particular case ?
------------------------------
André Leruitte
------------------------------