Forum Discussion

SecOps_AX-SP's avatar
SecOps_AX-SP
Icon for Nimbostratus rankNimbostratus
Aug 07, 2024

How to Disable fields after AD Password expired

Hi everyone.

We have a F5 v17.1.0.3 with APM Profile configured in standard mode customization configuration. 

We would like to disable the fields "New Password" and "Verify Password" after the AD responds with message "Password Expired". The AAA error message we modified without problems, editing the AAA error message custom.

Its possible to disable these fields "New Password" and Verify Password?

 

Regards.

APM
  • Injeyan_Kostas's avatar
    Injeyan_Kostas
    Icon for Cirrus rankCirrus
    Aug 11, 2024

    If I understand well, you do not want to give user the option to create new password when previous one is expired.

    This is actually a default behavior of AD Auth

     

    One option is to use AD Query before AD Auth and add this "Expression: expr {[mcget {session.ad.last.queryresult}] == 0 && [ string tolower [mcget {session.ad.last.errmsg}]] contains [ string tolower "Password has expired"]}" as a branch with a custom deny ending.

     

    Second option is to use LDAP Auth instead AD Auth.

    • SecOps_AX-SP's avatar
      SecOps_AX-SP
      Icon for Nimbostratus rankNimbostratus
      Sep 27, 2024

      Thanks Injeyan.

       

      Finally we used the LDAP Auth option.

      This involved changing the config in the Auth policy but it worked fine. 🙂

       

      Regards.