LDAP password authn flow interception

[Cantor, Scott]

On 7/30/15, 12:26 PM, "users on behalf of O'Dowd, Josh" <users-bounces at shibboleth.net on behalf of Josh.O'Dowd at mso.umt.edu> wrote:



>Sorry that I am not being clear enough.  I don't need to re-authenticate.
>We just need to pause after ldap authentication and run a quick custom subflow, the end of which needs to return to the original flow from where we paused, the end result being that the user is returned to the SP, fully authenticated.

Ok, that would be an intercept then, except...

>My question is, can we do the custom sub-flow (I would need, at minimum, the LdapResponseContext sent in). 

That object isn't there, I don't think (unless it's part of the data stored with the Subject). Attributes resolved by the regular resolver are available. I think the Java Subject does retain attributes looked up during authentication too though.

> If so, where/how would I configure the call to it.

A custom intercept flow has to be named intercept/yourname, is registered with a descriptor bean in profile-intercept.xml, and is stored in a flow file in flows/intercept/yourname/yourname-flow.xml.

Adding p:postAuthenticationFlows="#{'yourname'}" to the Shibboleth.SSO or SAML2.SSO profile config beans will enable the intercept for those profiles. Your flow doesn't in general need to do anything to "resume" except ensure it ends in a proceed event, but if you have a view, it "resumes" by POSTing back to the $flowExecutionUrl variable.

-- Scott