Forum Discussion

SecOps_AX-SP's avatar
SecOps_AX-SP
Icon for Nimbostratus rankNimbostratus
Aug 07, 2024

How to Disable fields after AD Password expired

Hi everyone.

We have a F5 v17.1.0.3 with APM Profile configured in standard mode customization configuration. 

We would like to disable the fields "New Password" and "Verify Password" after the AD responds with message "Password Expired". The AAA error message we modified without problems, editing the AAA error message custom.

Its possible to disable these fields "New Password" and Verify Password?

 

Regards.

  • If I understand well, you do not want to give user the option to create new password when previous one is expired.

    This is actually a default behavior of AD Auth

     

    One option is to use AD Query before AD Auth and add this "Expression: expr {[mcget {session.ad.last.queryresult}] == 0 && [ string tolower [mcget {session.ad.last.errmsg}]] contains [ string tolower "Password has expired"]}" as a branch with a custom deny ending.

     

    Second option is to use LDAP Auth instead AD Auth.

    • SecOps_AX-SP's avatar
      SecOps_AX-SP
      Icon for Nimbostratus rankNimbostratus

      Thanks Injeyan.

       

      Finally we used the LDAP Auth option.

      This involved changing the config in the Auth policy but it worked fine. 🙂

       

      Regards.