LDAP password authn flow interception

[O'Dowd, Josh]

Thanks a ton, Scott.  Last question, based on your response...

Looking at the expiring-password-flow, the LdapResponseContext is a subcontext of the AuthenticationContext.  Any chance the AuthenticationContext makes it into intercepts, or is it missing because it is a post-authentication flow?

-Josh

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Thursday, July 30, 2015 10:57 AM
To: Shib Users
Subject: Re: LDAP password authn flow interception

On 7/30/15, 12:26 PM, "users on behalf of O'Dowd, Josh" <users-bounces at shibboleth.net on behalf of Josh.O'Dowd at mso.umt.edu> wrote:



>Sorry that I am not being clear enough.  I don't need to re-authenticate.
>We just need to pause after ldap authentication and run a quick custom subflow, the end of which needs to return to the original flow from where we paused, the end result being that the user is returned to the SP, fully authenticated.

Ok, that would be an intercept then, except...

>My question is, can we do the custom sub-flow (I would need, at minimum, the LdapResponseContext sent in). 

That object isn't there, I don't think (unless it's part of the data stored with the Subject). Attributes resolved by the regular resolver are available. I think the Java Subject does retain attributes looked up during authentication too though.

> If so, where/how would I configure the call to it.

A custom intercept flow has to be named intercept/yourname, is registered with a descriptor bean in profile-intercept.xml, and is stored in a flow file in flows/intercept/yourname/yourname-flow.xml.

Adding p:postAuthenticationFlows="#{'yourname'}" to the Shibboleth.SSO or SAML2.SSO profile config beans will enable the intercept for those profiles. Your flow doesn't in general need to do anything to "resume" except ensure it ends in a proceed event, but if you have a view, it "resumes" by POSTing back to the $flowExecutionUrl variable.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net