LDAP password authn flow interception

[Cantor, Scott]

On 7/30/15, 11:06 AM, "users on behalf of O'Dowd, Josh" <users-bounces at shibboleth.net on behalf of Josh.O'Dowd at mso.umt.edu> wrote:



>Thanks for your quick  responses and I don't mean to keep bothering on this, but in looking at the context-check-intercept, it seems we would just be getting an error message that I could map to a view, but would not get the user back to the SP.  Is that accurate?

I assumed that's what you wanted, you didn't really say.

>So I think I need to do a separate intercept flow that:
>	- checks for the attribute
>	- if missing, shows a form-view for the user to set security Q&A
>	- on submit, write the data to the directory
>	- send user back to the authn flow

That's not an intercept, then. You can't go back and redo authentication (well, not easily).

>...  similar to the exiring-password-flow.  I know how to do all of those things.  Where I get fuzzy is how to implement a custom intercept flow.

Won't fly anyway, based on the above, unless you don't have to redo authentication.

-- Scott