IdP v3.2.1 and Jetty 9.3.x canonicalization

[King, David]

Tom and Scott, thanks for the feedback and information.

Today I built a working lookup mechanism using your information, the wiki, and looking at the IdP source code.  Basically I wrote a simple Java Bean that updates the username if the lookup finds a different value.  I then added it to the system/flows/authn/password-authn-beans.xml and modified the system/flows/authn/password-authn-flows.xml to put it between the ExtractUsernamePasswordFromFormRequest and ValidateUsernamePassword.  I have attached the relevant section of the flow below. 

My main question is whether I should edit the main password flow or create a new password flow and update the IdP properties.  What is considered the better practice in the long run?

If we go with a new flow is it as straightforward as:

1) Updating the idp.authn.flows and idp.authn.flows.initial with the new flow name (say BUPassword).

2) Creating an /opt/shibboleth-idp/flows/authn/BUPassword directory with both the beans and flows files.

3) Change the name of the authn/Password bean in the authn/general-authn.xml file to reference the new flow (authn/BUPassword bean).

Is there anything else I need to do?  I can update the wiki once I am done with this if others are interested.

Thanks again for the help,
David

-- relevant section of the password flow --

    <action-state id="ExtractUsernamePasswordFromFormRequest">
        <evaluate expression="ExtractUsernamePasswordFromFormRequest" />
        <evaluate expression="'proceed'" />

        <!-- Let the validate action handle any problems later. -->
        <transition to="BULookupUsername" />
    </action-state>

    <action-state id="BULookupUsername" >
        <evaluate expression="BULookupUsername" />
        <evaluate expression="'proceed'" />

        <!-- Let the validate action handle any problems later. -->
        <transition to="ValidateUsernamePassword" />
    </action-state>
    <action-state id="ValidateUsernamePassword" parent="authn/conditions#ValidateUsernamePassword">
        <evaluate expression="ValidateUsernamePassword" />
        <evaluate expression="'proceed'" />

        <transition on="proceed" to="proceed" />


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Tom Zeller
Sent: Wednesday, February 17, 2016 3:14 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: IdP v3.2.1 and Jetty 9.3.x canonicalization


>> Also, which IdP module implements the form-based username/password lookup?
> 
> The code is radically decomposed and is built out of Spring Web Flows that wire up small pieces of code. The authn/Password webflow is the one that does password authentication.

The SWF flow referred to is : system/flows/authn/password-authn-flow.xml, HTH.


-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net