Regarding Shibboleth IDP Login Page.

[David Langenberg]

On Tue, Dec 18, 2012 at 8:10 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> Seriously, we just got phished in this way (phisher cloned our IdP page
> >and once you entered creds would POST them to the IdP. As a response we
> >ended up modifying error.jsp to say something like, "Does this email look
> >familiar <img src="phishMsg.png" />?
> >  If so, call IT Security".
>
> David, can you file a RFE so I remember to add a nonce of some sort to the
> default page? I can't rely on a key like my custom handler can, but we
> have the login context to use, so I can do something based on that.


SIDP-568

Thanks Scott

Dave

-- 
David Langenberg
Identity & Access Management
The University of Chicago
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20121218/d166f8b1/attachment.html