Building a custom consent & password expiration plugin for Shib3

[dqluan]

Thanks Scott,

As for why I am trying to do that custom flow, it's because:


1) Custom business logic: The organization wants passwords not to expire
automatically after a date, but rather after that date, the user will have
3 more logins, each time they will be reminded, before the password
actually expires.


2) We don't have the TOU and password expiration data in LDAP, only in an
Oracle database, so we need custom SQL calls to check/update

2A) That the user has agreed to TOU, and which version of TOU did the user
agree to, and

2B) To check password "soft expiration" and "how many logins does this user
have left before hard expiration"


3) We cannot modify the Shib3 code itself.


Unfortunately, I cannot influence this requirement in any way, even to
accommodate what the technology can do, but I still need to make it happen
in a very tight timeline.

Thanks again! Any feedback or suggestions is really appreciated.

Quang Luan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20170518/8ff415a0/attachment.html>