LDAP password authn flow interception

[O'Dowd, Josh]

Thanks,

> That's not an intercept, then. You can't go back and redo authentication (well, not easily).
Sorry that I am not being clear enough.  I don't need to re-authenticate.
We just need to pause after ldap authentication and run a quick custom subflow, the end of which needs to return to the original flow from where we paused, the end result being that the user is returned to the SP, fully authenticated.

My question is, can we do the custom sub-flow (I would need, at minimum, the LdapResponseContext sent in).  If so, where/how would I configure the call to it.

Thanks Scott.

-Josh

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Thursday, July 30, 2015 9:17 AM
To: Shib Users
Subject: Re: LDAP password authn flow interception

On 7/30/15, 11:06 AM, "users on behalf of O'Dowd, Josh" <users-bounces at shibboleth.net on behalf of Josh.O'Dowd at mso.umt.edu> wrote:



>Thanks for your quick  responses and I don't mean to keep bothering on this, but in looking at the context-check-intercept, it seems we would just be getting an error message that I could map to a view, but would not get the user back to the SP.  Is that accurate?

I assumed that's what you wanted, you didn't really say.

>So I think I need to do a separate intercept flow that:
>	- checks for the attribute
>	- if missing, shows a form-view for the user to set security Q&A
>	- on submit, write the data to the directory
>	- send user back to the authn flow

That's not an intercept, then. You can't go back and redo authentication (well, not easily).

>...  similar to the exiring-password-flow.  I know how to do all of those things.  Where I get fuzzy is how to implement a custom intercept flow.

Won't fly anyway, based on the above, unless you don't have to redo authentication.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net