Extending the Shibboleth Authentication Workflow

[Joshua Brodie]

Hi:

We currently have Shibboleth Identity Provider v2.2 authenticating
users using JAAS against our Oracle database.

Based on request from stakeholders, I have to make a change to the
authentication workflow.

i.e. After a person successfully authenticates, the user will be
prompted to change password is he/she has not done so in last 60 days.

How best can this be implemented in Shibboleth IdP?

I am not an expert in JAAS - based on my preliminary investigation, it
may not be suitable for above workflow.

Any suggestions on how best to proceed?

Thanks.