LDAPAuthnConfiguration

<!-- Modify the authenticator to use the entry resolver -->
<bean name="anonSearchAuthenticator" class="org.ldaptive.auth.Authenticator" p:entryResolver-ref="bindSearchEntryResolver">
...
 
<bean id="bindSearchEntryResolver" class="org.ldaptive.auth.SearchEntryResolver" p:connectionFactory-ref="entryResolverPooledConnectionFactory" />
<bean id="entryResolverPooledConnectionFactory" class="org.ldaptive.PooledConnectionFactory" p:connectionConfig-ref="entryResolverConnectionConfig" p:name="entry-resolver-pool" />
<bean id="entryResolverConnectionConfig" parent="connectionConfig" p:connectionInitializers-ref="entryResolverConnectionInitializer" />
<bean id="entryResolverConnectionInitializer" class="org.ldaptive.BindConnectionInitializer" p:bindDn="%{idp.authn.LDAP.entryResolver.bindDN}">
  <property name="bindCredential">
    <bean class="org.ldaptive.Credential">
      <constructor-arg value="%{idp.authn.LDAP.entryResolver.bindDNCredential}" />
    </bean>
  </property>
</bean>

<!-- Connection Configuration -->
<bean id="connectionConfig" class="org.ldaptive.ConnectionConfig" abstract="true"
      p:ldapUrl="%{idp.authn.LDAP.ldapURL}"
      p:useStartTLS="%{idp.authn.LDAP.useStartTLS:true}"
      p:connectTimeout="%{idp.authn.LDAP.connectTimeout:PT3S}"
      p:responseTimeout="%{idp.authn.LDAP.responseTimeout:PT3S}"
      p:sslConfig-ref="sslConfig" />

<alias name="%{idp.authn.LDAP.sslConfig:certificateTrust}" alias="sslConfig" />

<bean id="jvmTrust" class="org.ldaptive.ssl.SslConfig" />
<bean id="certificateTrust" class="org.ldaptive.ssl.SslConfig">
  <property name="credentialConfig">
    <bean parent="shibboleth.X509ResourceCredentialConfig" p:trustCertificates="%{idp.authn.LDAP.trustCertificates:undefined}" />
  </property>
</bean>
<bean id="keyStoreTrust" class="org.ldaptive.ssl.SslConfig">
  <property name="credentialConfig">
    <bean parent="shibboleth.KeystoreResourceCredentialConfig" p:truststore="%{idp.authn.LDAP.trustStore:undefined}" />
  </property>
</bean>

<!-- Pool Configuration -->
<bean id="connectionPool" class="org.ldaptive.PooledConnectionFactory" abstract="true"
      p:blockWaitTime="%{idp.pool.LDAP.blockWaitTime:PT3S}"
      p:minPoolSize="%{idp.pool.LDAP.minSize:3}"
      p:maxPoolSize="%{idp.pool.LDAP.maxSize:10}"
      p:validateOnCheckOut="%{idp.pool.LDAP.validateOnCheckout:false}"
      p:validatePeriodically="%{idp.pool.LDAP.validatePeriodically:true}"
      p:pruneStrategy-ref="pruneStrategy"
      p:validator-ref="searchValidator"
      p:failFastInitialize="%{idp.pool.LDAP.failFastInitialize:false}" />
<bean id="pruneStrategy" class="org.ldaptive.pool.IdlePruneStrategy"
      p:prunePeriod="%{idp.pool.LDAP.prunePeriod:PT5M}"
      p:idleTime="%{idp.pool.LDAP.idleTime:PT10M}" />
<bean id="searchValidator" class="org.ldaptive.SearchConnectionValidator" p:validatePeriod="%{idp.pool.LDAP.validatePeriod:PT5M}"/>

<!-- Authentication handler -->
<bean id="authHandler" class="org.ldaptive.auth.SimpleBindAuthenticationHandler" p:connectionFactory-ref="bindPooledConnectionFactory" />
<bean id="bindPooledConnectionFactory" class="org.ldaptive.PooledConnectionFactory" parent="connectionPool"
      p:name="bind-pool"
      p:connectionConfig-ref="bindConnectionConfig" />
<bean id="bindConnectionConfig" parent="connectionConfig" />

<!-- Anonymous Search Configuration -->
<bean name="anonSearchAuthenticator" class="org.ldaptive.auth.Authenticator" p:resolveEntryOnFailure="%{idp.authn.LDAP.resolveEntryOnFailure:false}">
  <constructor-arg index="0" ref="anonSearchDnResolver" />
  <constructor-arg index="1" ref="authHandler" />
</bean>
<bean id="anonSearchDnResolver" class="net.shibboleth.idp.authn.TemplateSearchDnResolver"
      p:baseDn="#{'%{idp.authn.LDAP.baseDN:undefined}'.trim()}"
      p:subtreeSearch="%{idp.authn.LDAP.subtreeSearch:false}"
      p:connectionFactory-ref="anonSearchPooledConnectionFactory" >
  <constructor-arg index="0" ref="shibboleth.VelocityEngine" />
  <constructor-arg index="1" value="#{'%{idp.authn.LDAP.userFilter:undefined}'.trim()}" />
</bean>
<bean id="anonSearchPooledConnectionFactory" class="org.ldaptive.PooledConnectionFactory" parent="connectionPool"
      p:name="search-pool"
      p:connectionConfig-ref="anonSearchConnectionConfig" />
<bean id="anonSearchConnectionConfig" parent="connectionConfig" />

<bean name="aggregateAuthenticator" class="org.ldaptive.auth.Authenticator">
  <constructor-arg index="0" ref="aggregateDnResolver" />
  <constructor-arg index="1" ref="aggregateAuthHandler" />
</bean>
<bean id="aggregateDnResolver" class="org.ldaptive.auth.AggregateDnResolver">
  <constructor-arg index="0">
    <util:map id="dnResolvers">
      <entry key="filter1" value-ref="dnResolver1" />
      <entry key="filter2" value-ref="dnResolver2" />
    </util:map>
  </constructor-arg>
</bean>
<bean id="aggregateAuthHandler" class="org.ldaptive.auth.AggregateAuthenticationHandler">
  <constructor-arg index="0">
    <!-- Use the same authentication handler for both DN resolvers -->
    <util:map id="authHandlers">
      <entry key="filter1" value-ref="authHandler" />
      <entry key="filter2" value-ref="authHandler" />
    </util:map>
  </constructor-arg>
</bean>

<!-- Define two DN resolvers that use anonymous search against the same directory -->
<bean id="dnResolver1" class="org.ldaptive.auth.SearchDnResolver" p:baseDn="%{idp.authn.LDAP.baseDN1}"
      p:subtreeSearch="%{idp.authn.LDAP.subtreeSearch:false}" p:userFilter="%{idp.authn.LDAP.userFilter1}"
      p:connectionFactory-ref="anonSearchPooledConnectionFactory" />
<bean id="dnResolver2" class="org.ldaptive.auth.SearchDnResolver" p:baseDn="%{idp.authn.LDAP.baseDN2}"
      p:subtreeSearch="%{idp.authn.LDAP.subtreeSearch:false}" p:userFilter="%{idp.authn.LDAP.userFilter2}"
      p:connectionFactory-ref="anonSearchPooledConnectionFactory" />

<util:list id="shibboleth.authn.Password.Validators">
    <!-- Default bean uses the settings defined in ldap.properties -->
    <bean parent="shibboleth.LDAPValidator" p:authenticator-ref="aggregateAuthenticator" />
</util:list>

<bean name="aggregateAuthenticator" class="org.ldaptive.auth.Authenticator">
  <constructor-arg index="0" ref="aggregateDnResolver" />
  <constructor-arg index="1" ref="aggregateAuthHandler" />
</bean>
<bean id="aggregateDnResolver" class="org.ldaptive.auth.AggregateDnResolver">
  <constructor-arg index="0">
    <util:map id="dnResolvers">
      <entry key="directory1" value-ref="dnResolver1" />
      <entry key="directory2" value-ref="dnResolver2" />
    </util:map>
  </constructor-arg>
</bean>
<bean id="aggregateAuthHandler" class="org.ldaptive.auth.AggregateAuthenticationHandler">
  <constructor-arg index="0">
    <util:map id="authHandlers">
      <entry key="directory1" value-ref="authHandler1" />
      <entry key="directory2" value-ref="authHandler2" />
    </util:map>
  </constructor-arg>
</bean>
<!-- define DN resolvers and authentication handlers for each directory... -->

<!-- Properties:
- idp.authn.LDAP.authenticator = aggregateAuthenticator
- idp.authn.LDAP.ldapURL1
- idp.authn.LDAP.ldapURL2
- idp.authn.LDAP.baseDN1
- idp.authn.LDAP.baseDN2
- idp.authn.LDAP.userFilter1
- idp.authn.LDAP.userFilter2
- idp.authn.LDAP.bindDN1
- idp.authn.LDAP.bindDN2
- idp.authn.LDAP.bindDNCredential1
- idp.authn.LDAP.bindDNCredential2
-->
<bean id="aggregateAuthenticator" class="org.ldaptive.auth.Authenticator"
      c:resolver-ref="aggregateDnResolver"
      c:handler-ref="aggregateAuthHandler" />

<!-- Aggregate DN resolution -->
<bean id="aggregateDnResolver" class="org.ldaptive.auth.AggregateDnResolver" p:allowMultipleDns="true">
  <constructor-arg index="0">
    <util:map id="dnResolvers">
      <entry key="directory1" value-ref="bindSearchDnResolver1" />
      <entry key="directory2" value-ref="bindSearchDnResolver2" />
    </util:map>
  </constructor-arg>
</bean>

<!-- DN resolver 1 -->
<bean id="bindSearchDnResolver1" class="org.ldaptive.auth.SearchDnResolver"
      p:baseDn="#{'%{idp.authn.LDAP.baseDN1:undefined}'.trim()}"
      p:subtreeSearch="%{idp.authn.LDAP.subtreeSearch:false}"
      p:userFilter="#{'%{idp.authn.LDAP.userFilter1:undefined}'.trim()}"
      p:connectionFactory-ref="bindSearchPooledConnectionFactory" />
<bean id="bindSearchPooledConnectionFactory1" class="org.ldaptive.PooledConnectionFactory" parent="connectionPool"
      p:name="search-pool1"
      p:connectionConfig-ref="bindSearchConnectionConfig1" />
<bean id="bindSearchConnectionConfig1" parent="connectionConfig"
      p:connectionInitializers-ref="bindConnectionInitializer1"
      p:ldapUrl="%{idp.authn.LDAP.ldapURL1}" />
<bean id="bindConnectionInitializer1" class="org.ldaptive.BindConnectionInitializer"
      p:bindDn="#{'%{idp.authn.LDAP.bindDN1:undefined}'.trim()}">
  <property name="bindCredential">
    <bean class="org.ldaptive.Credential" c:password="%{idp.authn.LDAP.bindDNCredential1:undefined}" />
  </property>
</bean>
<!-- DN resolver 2 -->
<bean id="bindSearchDnResolver2" class="org.ldaptive.auth.SearchDnResolver"
      p:baseDn="#{'%{idp.authn.LDAP.baseDN2:undefined}'.trim()}"
      p:subtreeSearch="%{idp.authn.LDAP.subtreeSearch:false}"
      p:userFilter="#{'%{idp.authn.LDAP.userFilter2:undefined}'.trim()}"
      p:connectionFactory-ref="bindSearchPooledConnectionFactory" />
<bean id="bindSearchPooledConnectionFactory2" class="org.ldaptive.PooledConnectionFactory" parent="connectionPool"
      p:name="search-pool2"
      p:connectionConfig-ref="bindSearchConnectionConfig2" />
<bean id="bindSearchConnectionConfig2" parent="connectionConfig"
      p:connectionInitializers-ref="bindConnectionInitializer2"
      p:ldapUrl="%{idp.authn.LDAP.ldapURL2}" />
<bean id="bindConnectionInitializer2" class="org.ldaptive.BindConnectionInitializer"
      p:bindDn="#{'%{idp.authn.LDAP.bindDN2:undefined}'.trim()}">
  <property name="bindCredential">
    <bean class="org.ldaptive.Credential" c:password="%{idp.authn.LDAP.bindDNCredential2:undefined}" />
  </property>
</bean>

<!-- Aggregate authentication -->
<bean id="aggregateAuthHandler" class="org.ldaptive.auth.AggregateAuthenticationHandler">
  <constructor-arg index="0">
    <util:map id="authHandlers">
      <entry key="directory1" value-ref="authHandler1" />
      <entry key="directory2" value-ref="authHandler2" />
    </util:map>
  </constructor-arg>
</bean>

<!-- Authentication handler 1 -->
<bean id="authHandler1" class="org.ldaptive.auth.SimpleBindAuthenticationHandler"
      p:connectionFactory-ref="bindPooledConnectionFactory1" />
<bean id="bindPooledConnectionFactory1" class="org.ldaptive.PooledConnectionFactory" parent="connectionPool"
      p:name="bind-pool1"
      p:connectionConfig-ref="bindConnectionConfig1" />
<bean id="bindConnectionConfig1" parent="connectionConfig"
      p:ldapUrl="%{idp.authn.LDAP.ldapURL1}" />
<!-- Authentication handler 2 -->
<bean id="authHandler2" class="org.ldaptive.auth.SimpleBindAuthenticationHandler"
      p:connectionFactory-ref="bindPooledConnectionFactory2" />
<bean id="bindPooledConnectionFactory2" class="org.ldaptive.PooledConnectionFactory" parent="connectionPool"
      p:name="bind-pool2"
      p:connectionConfig-ref="bindConnectionConfig2" />
<bean id="bindConnectionConfig2" parent="connectionConfig"
      p:ldapUrl="%{idp.authn.LDAP.ldapURL2}" />

# Use password policy control
idp.authn.LDAP.usePasswordPolicy = true

<entry key="AccountLocked">
    <list>
        <value>ACCOUNT_LOCKED</value>
    </list>
</entry>

<!-- authenticator with entry resolver-->
<bean id="adAuthenticator" class="org.ldaptive.auth.Authenticator" p:entryResolver-ref="bindSearchEntryResolver" p:responseHandlers-ref="authenticationResponseHandler" p:resolveEntryOnFailure="false">
  <constructor-arg index="0" ref="formatDnResolver" />
  <constructor-arg index="1" ref="authHandler" />
</bean>

<!-- authentication response handler that defines a password expiration period and warning period -->
<!-- expiration period is the amount of time since a password was set that it will expire in period notation -->
<!-- expiration period is only used if the msDS-UserPasswordExpiryTimeComputed attributes cannot be read and pwdLastSet can be read -->
<!-- warning period is the amount of time before expiration to produce a warning in period notation. Warning period is only applied if an expiration period can be resolved. -->
<!-- note that this response handler has a default constructor without these properties if you don't want to override the defaults -->
<bean id="authenticationResponseHandler" class="org.ldaptive.auth.ext.ActiveDirectoryAuthenticationResponseHandler" >
  <constructor-arg index="0">
    <bean factory-method="parse" class="java.time.Period">
      <constructor-arg value="%{idp.authn.LDAP.expirationPeriod}" />
    </bean>
  </constructor-arg>
  <constructor-arg index="1">
    <bean factory-method="parse" class="java.time.Period">
      <constructor-arg value="%{idp.authn.LDAP.warningPeriod}" />
    </bean>
  </constructor-arg>
</bean>

<!-- Add an entry resolver to read the pwdLastSet, must be included in idp.authn.LDAP.returnAttributes -->
<bean id="bindSearchEntryResolver" class="org.ldaptive.auth.SearchEntryResolver" p:connectionFactory-ref="entryResolverPooledConnectionFactory" />
<bean id="entryResolverPooledConnectionFactory" class="org.ldaptive.PooledConnectionFactory" parent="connectionPool" p:name="entry-resolver-pool" p:connectionConfig-ref="entryResolverConnectionConfig" />
<bean id="entryResolverConnectionConfig" parent="connectionConfig" p:connectionInitializers-ref="entryResolverConnectionInitializer" />
<bean id="entryResolverConnectionInitializer" class="org.ldaptive.BindConnectionInitializer" p:bindDn="%{idp.authn.LDAP.entryResolver.bindDN}">
  <property name="bindCredential">
    <bean class="org.ldaptive.Credential">
      <constructor-arg value="%{idp.authn.LDAP.entryResolver.bindDNCredential}" />
    </bean>
  </property>
</bean>

<!-- Define Directory1 connection pool -->
<bean id="adConnectionPool1" class="org.ldaptive.PooledConnectionFactory" abstract="true"
      p:blockWaitTime="%{idp.pool.LDAP.blockWaitTime:PT3S}"
      p:minPoolSize="%{idp.pool.LDAP.minSize:3}"
      p:maxPoolSize="%{idp.pool.LDAP.maxSize:10}"
      p:validateOnCheckOut="%{idp.pool.LDAP.validateOnCheckout:false}"
      p:validatePeriodically="%{idp.pool.LDAP.validatePeriodically:true}"
      p:pruneStrategy-ref="adPruneStrategy1"
      p:validator-ref="adSearchValidator1"
      p:failFastInitialize="%{idp.pool.LDAP.failFastInitialize:false}" />
<bean id="adPruneStrategy1" class="org.ldaptive.pool.IdlePruneStrategy"
      p:prunePeriod="%{idp.pool.LDAP.prunePeriod:PT5M}"
      p:idleTime="%{idp.pool.LDAP.idleTime:PT10M}" />
<bean id="adSearchValidator1" class="org.ldaptive.SearchConnectionValidator"
      p:validatePeriod="%{idp.pool.LDAP.validatePeriod:PT5M}" />
<!-- Directory1 connection pool settings -->
<bean id="adConnectionConfig1" class="org.ldaptive.ConnectionConfig" abstract="true"
      p:ldapUrl="%{idp.authn.LDAP.ldapURL1}"
      p:useStartTLS="%{idp.authn.LDAP.useStartTLS1:true}"
      p:connectTimeout="%{idp.authn.LDAP.connectTimeout1:PT3S}"
      p:sslConfig-ref="adSslConfig1" />
<alias name="%{idp.authn.LDAP.sslConfig:certificateTrust}" alias="adSslConfig1" />
<!-- Define Directory2 connection pool -->
<bean id="adConnectionPool2" class="org.ldaptive.PooledConnectionFactory" abstract="true"
      p:blockWaitTime="%{idp.pool.LDAP.blockWaitTime:PT3S}"
      p:minPoolSize="%{idp.pool.LDAP.minSize:3}"
      p:maxPoolSize="%{idp.pool.LDAP.maxSize:10}"
      p:validateOnCheckOut="%{idp.pool.LDAP.validateOnCheckout:false}"
      p:validatePeriodically="%{idp.pool.LDAP.validatePeriodically:true}"
      p:pruneStrategy-ref="adPruneStrategy2"
      p:validator-ref="adSearchValidator2"
      p:failFastInitialize="%{idp.pool.LDAP.failFastInitialize:false}" />
<bean id="adPruneStrategy2" class="org.ldaptive.pool.IdlePruneStrategy"
      p:prunePeriod="%{idp.pool.LDAP.prunePeriod:PT5M}"
      p:idleTime="%{idp.pool.LDAP.idleTime:PT10M}" />
<bean id="adSearchValidator2" class="org.ldaptive.SearchConnectionValidator"
      p:validatePeriod="%{idp.pool.LDAP.validatePeriod:PT5M}" />
<!-- Directory2 connection pool settings -->
<bean id="adConnectionConfig2" class="org.ldaptive.ConnectionConfig" abstract="true"
      p:ldapUrl="%{idp.authn.LDAP.ldapURL3}"
      p:useStartTLS="%{idp.authn.LDAP.useStartTLS3:true}"
      p:connectTimeout="%{idp.authn.LDAP.connectTimeout3:PT3S}"
      p:sslConfig-ref="adSslConfig2" />
<alias name="%{idp.authn.LDAP.sslConfig:certificateTrust}" alias="adSslConfig2" />

<!-- ldap.properties "idp.authn.LDAP.authenticator = adAggregateAuthenticator" -->
<bean id="adAggregateAuthenticator" class="org.ldaptive.auth.Authenticator"
      p:responseHandlers-ref="adAuthenticationResponseHandler">
  <constructor-arg index="0" ref="adAggregateDnResolver" />
  <constructor-arg index="1" ref="adAggregateAuthHandler" />
</bean>
<bean id="adAuthenticationResponseHandler" class="org.ldaptive.auth.ext.ActiveDirectoryAuthenticationResponseHandler" />
<bean id="adAggregateDnResolver" class="org.ldaptive.auth.AggregateDnResolver">
  <constructor-arg index="0" ref="adDnResolvers" />
</bean>
<bean id="adAggregateAuthHandler" class="org.ldaptive.auth.AggregateAuthenticationHandler"
      p:authenticationHandlers-ref="adAuthHandlers" />
<util:map id="adDnResolvers">
  <entry key="directory1_filter1" value-ref="adDnResolver1" />
  <entry key="directory1_filter2" value-ref="adDnResolver2" />
  <entry key="directory2_filter3" value-ref="adDnResolver3" />
  <entry key="directory2_filter4" value-ref="adDnResolver4" />
</util:map>
<!-- Define two DN resolvers that use bind search against the Directory1 directory -->
<bean id="adDnResolver1" class="org.ldaptive.auth.SearchDnResolver"
      p:baseDn="%{idp.authn.LDAP.baseDN1}"
      p:subtreeSearch="%{idp.authn.LDAP.subtreeSearch1:false}"
      p:userFilter="%{idp.authn.LDAP.userFilter1}"
      p:connectionFactory-ref="adBindSearchPooledConnectionFactory1" />
<bean id="adDnResolver2" class="org.ldaptive.auth.SearchDnResolver"
      p:baseDn="%{idp.authn.LDAP.baseDN2}"
      p:subtreeSearch="%{idp.authn.LDAP.subtreeSearch2:false}"
      p:userFilter="%{idp.authn.LDAP.userFilter2}"
      p:connectionFactory-ref="adBindSearchPooledConnectionFactory1" />
<!-- Define two DN resolvers that use bind search against the Directory2 directory -->
<bean id="adDnResolver3" class="org.ldaptive.auth.SearchDnResolver"
      p:baseDn="%{idp.authn.LDAP.baseDN3}"
      p:subtreeSearch="%{idp.authn.LDAP.subtreeSearch3:false}"
      p:userFilter="%{idp.authn.LDAP.userFilter3}"
      p:connectionFactory-ref="adBindSearchPooledConnectionFactory2" />
<bean id="adDnResolver4" class="org.ldaptive.auth.SearchDnResolver"
      p:baseDn="%{idp.authn.LDAP.baseDN4}"
      p:subtreeSearch="%{idp.authn.LDAP.subtreeSearch4:false}"
      p:userFilter="%{idp.authn.LDAP.userFilter4}"
      p:connectionFactory-ref="adBindSearchPooledConnectionFactory2" />
<!-- Define Directory1 Search-pool -->
<bean id="adBindSearchPooledConnectionFactory1" class="org.ldaptive.PooledConnectionFactory"
      parent="adConnectionPool1"
      p:name="adSearch-pool1"
      p:connectionConfig-ref="adBindSearchConnectionConfig1" />
<bean id="adBindSearchConnectionConfig1"
      parent="adConnectionConfig1"
      p:connectionInitializers-ref="adBindConnectionInitializer1" />
<bean id="adBindConnectionInitializer1" class="org.ldaptive.BindConnectionInitializer"
      p:bindDn="%{idp.authn.LDAP.bindDN1}">
  <property name="bindCredential">
    <bean class="org.ldaptive.Credential">
      <constructor-arg value="%{idp.authn.LDAP.bindDNCredential1}" />
    </bean>
  </property>
</bean>
<!-- Define Directory2 Search-pool -->
<bean id="adBindSearchPooledConnectionFactory2" class="org.ldaptive.PooledConnectionFactory"
      parent="adConnectionPool2"
      p:name="adSearch-pool2"
      p:connectionConfig-ref="adBindSearchConnectionConfig2" />
<bean id="adBindSearchConnectionConfig2"
      parent="adConnectionConfig2"
      p:connectionInitializers-ref="adBindConnectionInitializer2" />
<bean id="adBindConnectionInitializer2" class="org.ldaptive.BindConnectionInitializer"
      p:bindDn="%{idp.authn.LDAP.bindDN3}">
  <property name="bindCredential">
    <bean class="org.ldaptive.Credential">
      <constructor-arg value="%{idp.authn.LDAP.bindDNCredential3}" />
    </bean>
  </property>
</bean>
<util:map id="adAuthHandlers">
  <entry key="directory1_filter1" value-ref="adAuthHandler1" />
  <entry key="directory1_filter2" value-ref="adAuthHandler1" />
  <entry key="directory2_filter3" value-ref="adAuthHandler2" />
  <entry key="directory2_filter4" value-ref="adAuthHandler2" />
</util:map>
<!-- Use the same authentication handler for both Directory1 DN resolvers -->
<bean id="adAuthHandler1" class="org.ldaptive.auth.SimpleBindAuthenticationHandler"
      p:connectionFactory-ref="adBindPooledConnectionFactory1" />
<bean id="adBindPooledConnectionFactory1" class="org.ldaptive.PooledConnectionFactory"
      parent="adConnectionPool1"
      p:name="adBind-pool1"
      p:connectionConfig-ref="adBindConnectionConfig1" />
<bean id="adBindConnectionConfig1"
      parent="adConnectionConfig1" />
<!-- Use the same authentication handler for both Directory2 DN resolvers -->
<bean id="adAuthHandler2" class="org.ldaptive.auth.SimpleBindAuthenticationHandler"
      p:connectionFactory-ref="adBindPooledConnectionFactory2" />
<bean id="adBindPooledConnectionFactory2" class="org.ldaptive.PooledConnectionFactory"
      parent="adConnectionPool2"
      p:name="adBind-pool2"
      p:connectionConfig-ref="adBindConnectionConfig2" />
<bean id="adBindConnectionConfig2"
      parent="adConnectionConfig2" />

   ...
        <entry key="AccountDisabled">
            <list>
                <value>ACCOUNT_DISABLED</value>
                <value>533</value>
            </list>
        </entry>
        <entry key="AccountExpired">
            <list>
                <value>ACCOUNT_EXPIRED</value>
            </list>
        </entry>
        <entry key="AccountLocked">
            <list>
                <value>ACCOUNT_LOCKED_OUT</value>
                <value>775</value>
            </list>
        </entry>
        <entry key="ChangePassword">
            <list>
                <value>PASSWORD_EXPIRED</value>
                <value>PASSWORD_MUST_CHANGE</value>
                <value>532</value>
            </list>
        </entry>
   ...

...
AccountDisabled = account-disabled
AccountExpired = account-expired
AccountLocked = account-locked
ChangePassword = change-password

account-disabled.message = Your account is disabled.
account-expired.message = Your account has expired.
account-locked.message = Your account is locked.
change-password.message = You must change your password before authenticating here.
...