Ken, The authentication provider should _not_ return reasons for failed login to clients. Log in and any items associated with it, such as password management, should be managed entirely by the auth provider. This is to prevent abuse by client applications as well as separation of concerns (who wants to add password management to every client app?).
I have not used the password management module. It can handle expired passwords, https://apereo.github.io/cas/6.3.x/password_management/Password-Management.html. Have you included the dependency? Ray On Tue, 2021-05-25 at 12:42 -0700, Ken Hopkins wrote: Notice: This message was sent from outside the University of Victoria email system. Please be cautious with links and sensitive information. I am using CAS as an OAuth2 server with REST Authentication. My client is a javascript application using the oauth2 password grant type. When trying to authenticate a user whose password is expired, my REST authentication endpoint is returning a 428 response as expected. I see a log message that indicates as much: INFO [org.apereo.cas.authentication.PolicyBasedAuthenticationManager] - <[RestAuthenticationHandler] exception details: [Account password must change for [email protected]].> However, my client application just receives a generic 401 response from CAS indicating the authentication failed, without any indication that the password was expired. Is this the expected behavior? Am I missing any configuration that would allow CAS to return a different response or header or response code to an OAuth2 Password Grant Type request? I'd like to be able to relay to the client that authentication failed because the password is expired. I've tried returning both the X-CAS-Warning and X-CAS-PasswordExpirationDate response headers from my REST Authentication endpoint, but they do not get propagated to the response to my Oauth client from CAS. I also enabled the password management module, but that didn't seem to help either. cas.authn.pm.core.enabled=true cas.authn.pm.webflow.enabled=true cas.authn.pm.enabled=true I'm currently using CAS version 6.2.5. Thanks, Ken -- - Website: https://apereo.github.io/cas - Gitter Chatroom: https://gitter.im/apereo/cas - List Guidelines: https://goo.gl/1VRrw7 - Contributions: https://goo.gl/mh7qDG --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/1c0c4bab368d703f598b0120d77c7c0c88693b4c.camel%40uvic.ca.
