Situation
LDAP as authentication source in SimpleSAMLphp
LDAP password policy overlay
When using ppolicy password aging, no messages are shown when logging in with SimpleSAMLphp.
If the password is almost expired (pwdExpireWarning) a warning is sent by LDAP.
New developments
That warning can be caught as of php 7.3 via the LDAP control LDAP_CONTROL_PASSWORDPOLICYREQUEST.
See php manual pages LDAP controls and Example #1 Bind with ppolicy information
Solution
If ppolicy handling is enabled via new ldap module config, show the message to the user before continuing to the SP. The message shown should be configurable, for example to set a link where users will be able to change their password.
Situation
LDAP as authentication source in SimpleSAMLphp
LDAP password policy overlay
When using ppolicy password aging, no messages are shown when logging in with SimpleSAMLphp.
If the password is almost expired (pwdExpireWarning) a warning is sent by LDAP.
New developments
That warning can be caught as of php 7.3 via the LDAP control LDAP_CONTROL_PASSWORDPOLICYREQUEST.
See php manual pages LDAP controls and Example #1 Bind with ppolicy information
Solution
If ppolicy handling is enabled via new ldap module config, show the message to the user before continuing to the SP. The message shown should be configurable, for example to set a link where users will be able to change their password.