Intercept LDAP password expired

FWIW I had a similar problem using TACACS authentication with the ACA module. The response from support was that it doesn't get passed back (Of course LDAP may be different, but I suspect not).

 

 

I did actually raise a request to have this fixed, and IIRC a CR was opened for it (But low priority. Let me have a dig around and I'll see what I can find).

 

 

H

Can you reset the password so it's not expired and check to what in the LDAP attributes changes?

 

 

Aaron

Following the result when the authentication successfully

Jul  5 11:36:27 tmm tmm[1605]: Rule LdapHT : SALVA -- ldap:attr:logonCount = 0
Jul  5 11:36:27 tmm tmm[1605]: Rule LdapHT : SALVA -- ldap:attr:codePage = 0
Jul  5 11:36:27 tmm tmm[1605]: Rule LdapHT : SALVA -- ldap:attr:badPasswordTime = 129224645700625000
Jul  5 11:36:27 tmm tmm[1605]: Rule LdapHT : SALVA -- ldap:attr:name = pippo pippo
Jul  5 11:36:27 tmm tmm[1605]: Rule LdapHT : SALVA -- ldap:attr:cn = pippo pippo
Jul  5 11:36:27 tmm tmm[1605]: Rule LdapHT : SALVA -- ldap:attr:sn = pippo
Jul  5 11:36:27 tmm tmm[1605]: Rule LdapHT : SALVA -- ldap:attr:adminCount = 1
Jul  5 11:36:27 tmm tmm[1605]: Rule LdapHT : SALVA -- ldap:attr:whenCreated = 20100701125950.0Z
Jul  5 11:36:27 tmm tmm[1605]: Rule LdapHT : SALVA -- ldap:attr:pwdLastSet = 129227961255156250
Jul  5 11:36:27 tmm tmm[1605]: Rule LdapHT : SALVA -- ldap:attr:lastLogon = 129224646042031250
Jul  5 11:36:27 tmm tmm[1605]: Rule LdapHT : SALVA -- ldap:attr:badPwdCount = 0
Jul  5 11:36:27 tmm tmm[1605]: Rule LdapHT : SALVA -- ldap:attr:objectClass = user
Jul  5 11:36:27 tmm tmm[1605]: Rule LdapHT : SALVA -- ldap:attr:distinguishedName = CN=pippo pippo,CN=Users,DC=dominio,DC=test
Jul  5 11:36:27 tmm tmm[1605]: Rule LdapHT : SALVA -- ldap:attr:memberOf = CN=Administrators,CN=Builtin,DC=dominio,DC=test
Jul  5 11:36:27 tmm tmm[1605]: Rule LdapHT : SALVA -- ldap:attr:countryCode = 0
Jul  5 11:36:27 tmm tmm[1605]: Rule LdapHT : SALVA -- ldap:attr:displayName = pippo pippo
Jul  5 11:36:27 tmm tmm[1605]: Rule LdapHT : SALVA -- ldap:attr:sAMAccountType = 805306368
Jul  5 11:36:27 tmm tmm[1605]: Rule LdapHT : SALVA -- ldap:attr:objectGUID = Û∏?Œ“k¸Jπ]]Û>Ã(b
Jul  5 11:36:27 tmm tmm[1605]: Rule LdapHT : SALVA -- ldap:attr:uSNChanged = 49161
Jul  5 11:36:27 tmm tmm[1605]: Rule LdapHT : SALVA -- ldap:attr:lastLogoff = 0
Jul  5 11:36:27 tmm tmm[1605]: Rule LdapHT : SALVA -- ldap:attr:userPrincipalName = pippo@dominio.test
Jul  5 11:36:27 tmm tmm[1605]: Rule LdapHT : SALVA -- ldap:attr:givenName = pippo
Jul  5 11:36:27 tmm tmm[1605]: Rule LdapHT : SALVA -- ldap:attr:whenChanged = 20100705093525.0Z
Jul  5 11:36:27 tmm tmm[1605]: Rule LdapHT : SALVA -- ldap:attr:objectCategory = CN=Person,CN=Schema,CN=Configuration,DC=dominio,DC=test
Jul  5 11:36:27 tmm tmm[1605]: Rule LdapHT : SALVA -- ldap:attr:accountExpires = 9223372036854775807
Jul  5 11:36:27 tmm tmm[1605]: Rule LdapHT : SALVA -- ldap:attr:userAccountControl = 512
Jul  5 11:36:27 tmm tmm[1605]: Rule LdapHT : SALVA -- ldap:attr:primaryGroupID = 513
Jul  5 11:36:27 tmm tmm[1605]: Rule LdapHT : SALVA -- ldap:attr:uSNCreated = 45090
Jul  5 11:36:27 tmm tmm[1605]: Rule LdapHT : SALVA -- ldap:attr:sAMAccountName = pippo
Jul  5 11:36:27 tmm tmm[1605]: Rule LdapHT : SALVA -- ldap:attr:objectSid =
Jul  5 11:36:27 tmm tmm[1605]: Rule LdapHT : SALVA -- ldap:attr:instanceType = 4

I think the only attribute that can be useful is ldap: attr: pwdLastSet. Calculating when the user has set the password might be possible to calculate when it expires ... not using tcl.

 

 

Is there any other solution?

 

 

Thanks, Salvatore

Have you tried logging a support call?

As Hamish suggested, it would be good to open a support case to find out what kind of method F5 would recommend.

 

 

Hard coding the expire time in an iRule might work if you check if the current time minus the last change time is less than the expiry time. But that would break if the password expiry time was changed on the LDAP server.

 

 

I did notice that the attribute Rule ldap:attr:adminCount = 1 is present in the unexpired request and not present in the expired request. If that's always the case, you might be able to use that to detect an expired password.

 

 

Aaron

Have you tried logging a support call? Yes, of course. Following the response to my request of information (Case Number C706610 opened 28th July 2010): Hi Salvatore, This would be a custom iRule modification. Your best bet would be to use the resources on devcentral.f5.com - perhaps asking in the forums, or contacting our professional services team who might be able to quote you on some iRule consultancy. Regards, I'm not happy for this answer.

I'd clarify with F5 Support that you're not asking them to write an iRule for you--you're trying to find out what is possible using a specific iRule command. It might help to reference Hamish's case if he can find the CR he received.

 

 

Aaron

Hi Salvatore, do you have solved this issue?

 

I am in the same situation.

 

Let me know please,

 

Regards, Marco

 

Hi,

 

with APM is easy. In VPE, on a "LDAP Auth" box, add a new branch with this expression: expr { [ mcget {session.ldap.last.errmsg}] contains "password expired"