LDAP password authn flow interception

[Cantor, Scott]

On 7/29/15, 5:27 PM, "users on behalf of O'Dowd, Josh" <users-bounces at shibboleth.net on behalf of Josh.O'Dowd at mso.umt.edu> wrote:



>Is it possible to interrupt the Password-authn-flow after a successful authn?  I am having the LDAP return an attribute, ‘securityQuestion’ from the authn bind using the idp.authn.LDAP.returnAttributes property because I need to verify that this attribute has been set in the directory before allowing authn completion to continue.

You can always just implement it as a plain intercept flow post-authentication.

> 
>My original idea  was to use the classifiedMessageMap for an event to trigger the conditions-flow but it looks like that is constrained to ldap error codes only.  Is there a success key that I could use?

The LDAP response object is org.ldaptive.auth.AuthenticationResponse. If getAccountState() is non-null, any error condition in the account state is mapped as a warning (meaning it doesn't fail the login, but it can trigger an event).

Outside of that, no.

-- Scott