IdPv3.x user password as attribute follow up

[Cantor, Scott]

On 8/14/15, 10:49 AM, "users on behalf of Christopher Greiner" <users-bounces at shibboleth.net on behalf of christopher.greiner at unil.ch> wrote:

>
>Someone already posted about this back in march
>(http://shibboleth.1660669.n2.nabble.com/idpv3-x-user-password-as-attribute-tt7612840.html)
>and Scott replied:
>
>"The password flow could do that with an enhancement, or it can be
>copied and customized by somebody to do that."
>
>Could you elaborate slightly on the enhancement or customisation needed
>for me to achieve this?

By "enhancement", I meant file a request and an option could be created that would appear in a future release. (Nobody has done so.)

By customization, I meant that since the current authn/Password login flow doesn't do this, you would not be able to use it unless it were changed (at the cost of editing system files and having to preserve them across upgrades by hand), or if the authn/Password flow were copied into a user-space flow  and then modified to add the feature.

The specific modification (probably) would be to create a new class based on an existing net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainst* class and have it add in the password as a private credential of the Java Subject it creates, which I think is what the old feature did.

The new class would have to be wired into the copied or modified flow's beans file in place of the standard one (the beans for that particular flow are in system/flows/authn/password-authn-beans.xml)

-- Scott