User-Defined Post Authentication Flows

[Marvin Addison]

On Mon, Aug 1, 2016 at 11:16 AM Cantor, Scott <cantor.2 at osu.edu> wrote:

> Why do you think incorrectly? My expiring password check is in that hook
> (it's the one I checked into trunk).
>

I hadn't seen that, thanks for mentioning it. Careful review reminded me of
the ProfileConfiguration knobs (inboundInterceptorFlows,
postAuthenticationFlows, outboundInterceptorFlows) that control when the
intercept flows fire. We are indeed using those to ensure that our custom
intercept flows fire post-authentication, but I had forgot and missed it in
my review. Also, I see it's fairly clearly documented on
https://wiki.shibboleth.net/confluence/display/IDP30/ProfileInterceptConfiguration#ProfileInterceptConfiguration-EnablingIntercepts.
So I misspoke about our misuse of intercept flows. Working as intended,
sorry.

> 3. Authentication method check based on 2-factor completion
> You shouldn't need that one at all, it would mean the authentication
> flow(s) themselves need to be fixed.


The authentication method is not static but a function of the data in the
AttributeContext. I don't know whether that's right or wrong, but those are
the requirements. I don't see any other way to accomplish it than via an
intercept flow that fiddles with the authenticated subject under certain
conditions.

Thanks,
M
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20160802/35c43486/attachment.html>