<div dir="ltr"><div class="gmail_default" style="font-family:trebuchet ms,sans-serif">Tough luck! If its tricky for you (FreeIPA core developers) then its pretty much impossible to solve it for mere mortals like me !</div></div><div class="gmail_extra"> <div class="gmail_quote">On 11 July 2016 at 19:43, Rob Crittenden <<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Prashant Bapat wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> I cherrypicked the commit id 3b7d5e7543a074d7d24556cadc6c95be9871cfc6 and compiled the ipa-pwd-extop slapi plugin. Now the user is denied bind. But unable to reset the password. </blockquote> Right, it's a tricky problem which is why it hasn't been resolved yet. You have come full circle through the same steps we went through. rob <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> On 8 July 2016 at 13:21, Martin Kosek <<a href="mailto:mkosek@redhat.com" target="_blank">mkosek@redhat.com</a> <mailto:<a href="mailto:mkosek@redhat.com" target="_blank">mkosek@redhat.com</a>>> wrote: On 07/07/2016 05:19 PM, Prashant Bapat wrote: > Anyone ?! > > On 6 July 2016 at 22:36, Prashant Bapat <<a href="mailto:prashant@apigee.com" target="_blank">prashant@apigee.com</a> <mailto:<a href="mailto:prashant@apigee.com" target="_blank">prashant@apigee.com</a>> > <mailto:<a href="mailto:prashant@apigee.com" target="_blank">prashant@apigee.com</a> <mailto:<a href="mailto:prashant@apigee.com" target="_blank">prashant@apigee.com</a>>>> wrote: > > Hi, > > We are using FreeIPA's LDAP as the base for user authentication in a > different application. So far I have created a sysaccount which does the > lookup etc for a user and things are working as expected. I'm even able to > use OTP from the external app. > > One problem I'm struggling to fix is the expired passwords. Is there a way > to deny bind to LDAP only from this application? Obviously the user would > need to go to IPA's web UI and reset his password there. > > I came across this tickethttps://<a href="http://fedorahosted.org/freeipa/ticket/1539" rel="noreferrer" target="_blank">fedorahosted.org/freeipa/ticket/1539</a> but > looks like this is an old one. > > Thanks. > --Prashant Hello Prashant, <a href="https://fedorahosted.org/freeipa/ticket/1539" rel="noreferrer" target="_blank">https://fedorahosted.org/freeipa/ticket/1539</a> seems to be the right ticket, if you want users with expired passwords to be denied, but it was not implemented yet. Help welcome! As a workaround, I assume you could simply leverage Kerberos for authentication - it does respect expired passwords. We have advise on how to integrate that to external web applications here: <a href="http://www.freeipa.org/page/Web_App_Authentication" rel="noreferrer" target="_blank">http://www.freeipa.org/page/Web_App_Authentication</a> Martin </blockquote> </blockquote></div> </div>