Duo IdPv3.3 c14n null principal.

[Cantor, Scott]

On 12/28/16, 3:54 PM, "users on behalf of Cantor, Scott" <users-bounces at shibboleth.net on behalf of cantor.2 at osu.edu> wrote:

>>    I think we just need some advice on how to implement our policy where expired, expiring, or reset password conditions
>> occur.  Again, we just want to sub-flow these so that we can get password renewed, and then send user on their way to
>> their requested service.

Actually, if this is LDAP, there might be ways to do this that I don't know how to use. If you get the LDAP wiring to treat some of these response codes as success instead of failure, somehow, that would be what you really want. The problem isn't so much the conditions firing as the fact that they're handled inside the validation bean as errors. If you got them to turn into warnings or successes, you wouldn't have to be doing all the surgery.

So perhaps that's the real answer.

That still requires getting the c14n regression fixed, but it addresses the question you're really asking about how to get the flow to behave the way you want.

-- Scott