Displaying a simple error page from a flow

[Wessel, Keith]

Scott,

It's a terminating flow: this SP requires 2FA, and you haven't signed up. Go sign up from an on-campus IP then sign into the SP again.

I made a simple flow, copied from the duo flow definition and paired down considerablyand made an accompanying .vm file pointed to from the view parameter.But I was treating it as an authn flow to the point where I listed it in the authn/general-authn.xml as a bean with its own name and, otherwise, pretty much identical to the authn/Duo bean. But when I try to call it from my script in my MFA configuration, it tells me no such flow.

So, if you were going to do a terminal display screen with static text, would you just throw an exception that I could trap and map to a message in error.vm? If so, what exception would I throw?

Or would you go with the simple flow? And if so, can you tell me what's needed besides a flow defition in $IDP_HOME/flows and accompanying Velocity template?

Thanks,
Keith

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Wednesday, December 07, 2016 3:04 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: Displaying a simple error page from a flow

On 12/7/16, 3:48 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:

> On the same project as I was working on earlier this week with a customized MFA flow, I want to display a message to
> users if they haven't enrolled for a Duo token but the SP they're signing into requires Duo.

Is the message a terminating one, or a mid-flow one that would be expected to let them resume what they were doing? That's a major distinction in terms of approach.

> I was going to create a flow for this purpose, but after reading the V3 authentication docs, it seems like a lot of work to
> create a custom authn flow that simply displays a velocity template with a static message.

No, that's not an authn flow no matter what.

> Is there any way to throw an exception from within a script in the MFA configuration that I could map to a specific error
> message within error.vm and related messages?

Yes, but that's if you want to terminate.

> Or is there some other easy way to have a custom message or velocity template displayed that I'm not thinking of?

Displaying a message mid-flow requires a flow, but a flow is very simple to build if all it has to do is render a single view, I can give you an example in like 10 lines if you need it, it's just a flow file with a view-state in it.

The MFA transition rules can run *any* webflow, not just "login flows". A login flow is something that follows a set of in/out guarantees and is expected to authenticate the subject, so that's a very different animal from just a simple ordinary "do something interesting" webflow stuck in the middle of the sequence.

-- Scott
 

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net