Duo IdPv3.3 c14n null principal.

[O'Dowd, Josh]

I am with you there.  Unfortunately, I am constrained by the current policy makers who have been spoiled in the past, with a CAS implementation that was customized to the teeth, before my time.

I have done quite a bit to compartmentalize the landscape, but there are some things they have gotten used to.

On the password expiration thing, I do agree that an authenticated password that has expired does not disqualify the user’s authenticity.  We like that our user gets a warning and an option to renew at the point of greatest use.  If expiration does occur, we are simply interrupting the process to enforce policy, rather than closing the authentication process down and sending them away.

Josh

From: users [mailto:users-bounces at shibboleth.net] On Behalf Of IAM David Bantz
Sent: Wednesday, December 28, 2016 2:40 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: Duo IdPv3.3 c14n null principal.


On Wed, Dec 28, 2016 at 11:43 AM, O'Dowd, Josh <Josh.O'Dowd at mso.umt.edu<mailto:Josh.O'Dowd at mso.umt.edu>> wrote:
I think we just need some advice on how to implement our policy where expired, expiring, or reset password conditions occur.  Again, we just want to sub-flow these so that we can get password renewed, and then send user on their way to their requested service.

That seems to my perhaps naive eyes to be building a lot of customization into the Identity Provider to have it act as a credential manager. We use an alternative strategy of referring any "help with credentials" issue to a separate service dedicated to helping folks maintain directory-based credentials. Just offering a different perspective.

David Bantz
UA OIT IAM
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161228/c70689dd/attachment.html>