Denying users to login based on pattern in multiple auth flows

[Simon Lundström]

On Fri, 2016-01-29 at 14:48:46 +0000, Cantor, Scott wrote:
> > We have multiple auth flows enabled (RemoteUser|SPNEGO|Password to
> > be exact) and we would like to be able to disallow users whos username
> > matches a list of patterns to login, preferably via RegExps.
> 
> That's really more of a function of the login mechanism, but it depends I guess on the user experience you want or need. Anything the IdP could do would be after the fact right now.
> 
> > Is it possible to use some kind of Activation Condition? Or Subject
> > Canonicalization?
> 
> Well, the condition is too early, you don't know the name there yet.
> 
> It wouldn't exactly be normal to use c14n as the gating function, but you *could*, yes, if that step fails, it should fail the overall login flow. But probably not in a recoverable way, of course, it would fail the login process.

Cool, we might try this in the mean time until the issue/jira that you
mention below gets done.

Got any pointers or things we should look for? Or is it self
explanatory?

> I think it probably could be done in a post-login intercept flow, with a Predicate that looks at the resulting name and evaluates it against the login flow inside the AuthenticationResult that's used to satisfy the request, but you do run into the same issues I've been discussing with another poster about authz and exactly how tight a guarantee the IdP provides about an intercept returning an error. I have an open issue to look at existing hook points and determine if we need a tighter approach people can use to build those kinds of rules.

Do you have an issue/Jira number for this, I couldn't find it = /

BR,
- Simon