dcwaterm / pwm

Automatically exported from code.google.com/p/pwm
0 stars 0 forks source link

Password Warning screen gets skipped #448

Closed GoogleCodeExporter closed 9 years ago

GoogleCodeExporter commented 9 years ago
What steps will reproduce the problem?
1. Create a user with the following properties inside the LDAP directory 
(eDirectory)
    - password will expire within the configured Password ExpireWarn Time of PWM
    - user does not have any responses setup

2. Configure PWM (nightly build) to:
    - force the setup of responses
    - Set Password ExpireWarn Time to a valid number

3. customize NAM login.jsp so that all logins through NAM are processed by
the PWM CommandServlet via checkAll.

4. As a user try to access a protected resource i.e. (company.com/myapp)

What is the expected output? What do you see instead?

I would expect the following:

1) User requests company.com/myapp
2) NAM detects the protected resource and redirects the User to the login.jsp
3) User provides valid credentials and presses login
4) the login.jsp of NAM calls the CommandServlet with checkAll
5) PWM forces the User to setup his/ her responses
6) PWM warns that the password will expire ver soon
7) PWM redirects the user back to company.com/myapp

The order of 5 and 6 can be swapped (depending on the priority).

I see instead:

All of the steps that I would expect, except step6 (Password ExpireWarn) is not 
being shown. When I logout and repeat the steps to reproduce the problem 
(responses are now setup) I do get the Password Warn.

It seems the Password warn check gets skipped when a redirect to the setup 
responses takes place.

Attached the relevant part of catalina.out (anonymized)

Original issue reported on code.google.com by sebastia...@gmail.com on 15 Aug 2013 at 1:52

Attachments:

GoogleCodeExporter commented 9 years ago
Attached a proposed patch for review.

Original comment by sebastia...@gmail.com on 21 Aug 2013 at 6:22

Attachments:

GoogleCodeExporter commented 9 years ago
Added to revision 600.

Original comment by jrivard on 24 Aug 2013 at 11:09