Duo IdPv3.3 c14n null principal.

[O'Dowd, Josh]

> Do you have the new password at that point? 

Yes, when they submit the password form in the sub-flow, I have a FormAction class that binds and validates the input.  I am using a FormValidator to write the new password back to the LDAP, handle any validation errors returned from directory, and then return a success event to the sub-flow.

> You could maybe tweak things a bit by essentially preparing the UsernamePasswordContext and then routing back to the Validate step. That's more along the lines of a supported piece of internal state.

I was starting to go there, thoughtfully a couple hours ago, but hadn't asked you about that yet.
  
So you are suggesting that if I also set that password in to the UPC and exit state back to ValidateUsernamePassword, that would effectually reauthenticate the user properly without sending them back to the login page, correct?

Josh

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Thursday, December 29, 2016 10:45 AM
To: Shib Users <users at shibboleth.net>
Subject: RE: Duo IdPv3.3 c14n null principal.

> We don't allow the redirect to the service until the new password 
> change form is completed; presented, validated, and processed via the 
> authn/condition/expired-password sub-flow.  They're stuck until they 
> comply.  Once they comply, we do not require them to re-authenticate.  
> That is when we do the manual c14n and fire a 'proceed' back to MFA, 
> completing the authn/Password factor.

Hmm. Do you have the new password at that point? You could maybe tweak things a bit by essentially preparing the UsernamePasswordContext and then routing back to the Validate step. That's more along the lines of a supported piece of internal state.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net