Forum Discussion

SecOps_AX-SP's avatar
SecOps_AX-SP
Icon for Nimbostratus rankNimbostratus
Aug 07, 2024

How to Disable fields after AD Password expired

Hi everyone.

We have a F5 v17.1.0.3 with APM Profile configured in standard mode customization configuration. 

We would like to disable the fields "New Password" and "Verify Password" after the AD responds with message "Password Expired". The AAA error message we modified without problems, editing the AAA error message custom.

Its possible to disable these fields "New Password" and Verify Password?

 

Regards.

APM
  • Injeyan_Kostas's avatar
    Injeyan_Kostas
    Icon for Altostratus rankAltostratus
    Aug 11, 2024

    If I understand well, you do not want to give user the option to create new password when previous one is expired.

    This is actually a default behavior of AD Auth

     

    One option is to use AD Query before AD Auth and add this "Expression: expr {[mcget {session.ad.last.queryresult}] == 0 && [ string tolower [mcget {session.ad.last.errmsg}]] contains [ string tolower "Password has expired"]}" as a branch with a custom deny ending.

     

    Second option is to use LDAP Auth instead AD Auth.