Forum Discussion
Injeyan_Kostas
Aug 11, 2024Cirrus
If I understand well, you do not want to give user the option to create new password when previous one is expired.
This is actually a default behavior of AD Auth
One option is to use AD Query before AD Auth and add this "Expression: expr {[mcget {session.ad.last.queryresult}] == 0 && [ string tolower [mcget {session.ad.last.errmsg}]] contains [ string tolower "Password has expired"]}" as a branch with a custom deny ending.
Second option is to use LDAP Auth instead AD Auth.
- SecOps_AX-SPSep 27, 2024Nimbostratus
Thanks Injeyan.
Finally we used the LDAP Auth option.
This involved changing the config in the Auth policy but it worked fine. 🙂
Regards.