Trapping a Java exception in the authentication flow for V3

[Wessel, Keith]

I've already considered removing the trailing slash, Scott. It's a last resort. I'd rather tell the user don't do that instead of just silently fixing the username for them.

Unfortunately, though, no, it doesn't display the Java exception as an error on the login form. It actually sends me to the IDP error page and uses the text of the runtime-error.message. I can, of course, craft the logic in runtime-error.message to look for this specific error, and that may be the best I can do. But I'd rather have the IDP re-display the login page and tell the user it's an invalid username. Is that doable without significant flow changes? If not, seems like I have two decent options: removing the slash or displaying a more friendly message on the dead-end error page.

Keith


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Wednesday, October 28, 2015 3:15 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: Trapping a Java exception in the authentication flow for V3

On 10/28/15, 4:03 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:



>When I log into my V3 IDP with a trailing slash on my username (don't' ask why I would do this, ask the user who found the bug), I get the following Java exception displayed a the bottom of the IDP error template page:
>
>java.lang.IllegalArgumentException: Empty nameString not allowed
>
>This is using Kerberos as my password authentication back-end. The error makes sense to me, but it wouldn't make any sense to an end user. Is there some way I can trpa this and map it to a user-friendly error message?

Is it displaying that when it redisplays the login form? Any exception message the login is raising can be mapped in the shibboleth.authn.Password.ClassifiedMessageMap bean in the password login config. Presumably it should be mapped to UnknownUsername, which is the first entry in the default map.

Probably the better option is that you can configure the shibboleth.authn.Password.Transforms bean in that same file to contain a regular expression to strip the slash.

Something like this I think:

<bean parent="shibboleth.Pair" p:first="^(.+)/$" p:second="$1" />


-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net