reCaptcha integration with IDPv3

[joller lee]

(First time post to mailing-list. If there are duplicate posts, sorry for
that)

Hi there,

I failed to find useful information after searching on the Internet, so
hopefully it's not an FAQ.

I'm trying to integrating reCaptcha onto IDPv3's login view.
I've done this before with IDPv2 with a servlet filter.
I find it difficult to do the same with IDPv3.
My target is to use the built-in LDAP user-password authn flow,
without writing code that requires compiling, nor touching the system files.

The reCaptcha user-response code has to be sent in the same HTTP-request
with the user/password,
and not until the reCaptcha has been confirmed to be correct
is the user/password validation ever attempted.
It's required to prevent robots from learning anything about the
credential.
I've considered using extended flow of the UserPassword module,
but that seems to fail to meet the requirement above.

Finally, I found a way to accomplish it, but in a quite tricky manner:

1. Add an "on-entry" element to the "ValidateUsernamePassword" action-state
in conditions-flow.xml,
    which is the parent state of all those with the same name.
    In the "on-entry" element, the reCaptcha validation is done,
    and if it fails, the `username' property of the UsernamePasswordContext
is set to null
    to prevent the LDAP authentication from being successful.
2. After the LDAP authentication fails, the transitions in the parent state
will be checked.
    So add one that checks the previous reCaptcha validation result and, on
failure, add some
    error message for display.

Although this method doesn't touch the files under the `system' folder,
it is so subtle so that I suspect it be subject to change with future
releases of IDP.
Is there any better way?

Thanks!
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160122/b9510817/attachment.html>