Hi
I'm messing around with some LDAP authentication for Anyconnect and have a couple of questions if anyone can help.
First, this may be an AD/LDAP thing but when I connect via Anyconnect with my AD credentials it works. All good. I disable my account in AD and it fails as expected and I get a debug saying this. However, I changed my password in AD and when I connected in Anyconnect I accidentally entered the previous password and it still connected. To be sure I then disconnected and reconnected with my new password and it still connected. A bit of playing around seems to confirm that I can connect with the existing and last password though I've not waited any significant length of time to see if that changes.
Is this an LDAP issue and is it expected?
A second thing I was trying was if I tick the "user must change password at next login" box in the AD account does this allow me to change via Anyconnect. It doesn't. My connection fails. What I am trying to simulate here is a user coming back from holiday and their AD password has expired. Can I get them to be prompted to change via the anyconnect process. Or can I get them connected then prompted much as you would on a wired connection to change their AD password. Maybe via a SBL process ?
Many thanks for any input.
J.
