Idp force changing initial password?

[Cantor, Scott]

On 8/20/13 10:31 AM, "Gene Matthews" <gmatthew at hitachi-cta.com> wrote:
>
>In our use case, initial users are going to be assigned a default/random
>password.  When they login for the first time, we would like the SSO
>process to detect it is a first time login (not sure how to do that --
>maybe an LDAP attribute)

There's no standard way to do that, so there's no built-in way to
accomplish it.

> and if so, force
> a password change. Is this doable with shibboleth-idp and, if so, can
>someone point me in the right direction?

You would have to build a custom login handler.

That strikes me as a class of error conditions coming back from the
authentication service that I should support special handling for, so I
will add that to the existing set of special flags in the V3 code.

-- Scott