Can an intercept trigger a re-resolution of attributes?

[Cantor, Scott]

> The password change opens in another window, so when the user is done
> changing password, they could go back to the expired password view page
> and click a "Continue" button/link.  The problem I've bumped into is
> that simply transitioning from the expired password view to the
> beginning of our intercept flow (where it checks the password status
> LDAP attribute) does not pick up any changes to the LDAP entry.

Meaning you're trying to prevent them skipping it I guess. I tend to think that's a bit more of a "do it in the login flow" use case. As I keep noting, while intercepts are fully supported in preventing a request from being services, they aren't well suited to impacting a login retroactively.

This will probably work better as a use case for the MFA feature.

> Is there a way to trigger re-resolution of (perhaps specific) attributes
> during an intercept flow?  Either as a flow action, or directing to
> another flow somehow?

You can, yes. 3.3 makes it easy (yes, I know) because there's a simple shortcut implemented now to run attribute resolution in a script. Doing it as a flow is possible, but you pretty much have to wire it up yourself, it's not something exposed that you can reuse.

The contract is, I think, documented in the wiki though.

https://wiki.shibboleth.net/confluence/display/IDP30/AttributeResolver

Bottom of page. Implemented in a single ResolveAttributes Java action bean, and then there's a companion bean to fo filtering.

> If it's not possible, I suspect we'll have to pull the password status
> check into the actual login flow somehow.  I'm having trouble figuring
> out where the "pre-resolution" of attributes is happening, though.

The "support" for attribute lookup during authentication, apart from the LDAP features, is like the initial-authn feature, pointless and badly implemented. If that's what you mean by pre-resolution.

"Normal" resolution happens shortly after authentication completes and before the interceptors run.

The MFA example shows how to do it in 3.3 in the middle of login and it doesn't store the results anywhere that the rest of the system will see them. That's more along the lines of what you want.

-- Scott