Forum Discussion
SecOps_AX-SP
Nimbostratus
NimbostratusHow to Disable fields after AD Password expired
Hi everyone.
We have a F5 v17.1.0.3 with APM Profile configured in standard mode customization configuration.
We would like to disable the fields "New Password" and "Verify Password" after the AD responds with message "Password Expired". The AAA error message we modified without problems, editing the AAA error message custom.
Its possible to disable these fields "New Password" and Verify Password?
Regards.
- Injeyan_Kostas
Cirrus
If I understand well, you do not want to give user the option to create new password when previous one is expired.
This is actually a default behavior of AD Auth
One option is to use AD Query before AD Auth and add this "Expression: expr {[mcget {session.ad.last.queryresult}] == 0 && [ string tolower [mcget {session.ad.last.errmsg}]] contains [ string tolower "Password has expired"]}" as a branch with a custom deny ending.
Second option is to use LDAP Auth instead AD Auth.
SecOps_AX-SPThanks Injeyan.
Finally we used the LDAP Auth option.
This involved changing the config in the Auth policy but it worked fine. 🙂
Regards.
