FreeIPA - Password Expiration

[Prashant Bapat]

Scott,

Thanks for the pointers. I'm able to modify the expiring-password intercept
flow to my needs. Something like below works;

 <on-start>
        <evaluate
expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext))"
result="flowScope.authenticationContext" />
        <evaluate
expression="authenticationContext.getSubcontext(T(net.shibboleth.idp.authn.context.LDAPResponseContext))"
result="flowScope.ldapResponseContext" />
        <evaluate
expression="ldapResponseContext.getAuthenticationResponse().getLdapEntry().getAttribute('krbPasswordExpiration').getStringValue()"
result="flowScope.expirationDateString" />
        <evaluate
expression="T(org.slf4j.LoggerFactory).getLogger('net.shibboleth.idp.profile').debug(expirationDateString)"
/>
        <evaluate
expression="T(org.joda.time.DateTime).parse(expirationDateString,
T(org.joda.time.format.DateTimeFormat).forPattern("yyyyMMddHHmmss'Z'"))"
result="flowScope.expirationDate" />
        <evaluate expression="T(org.joda.time.DateTime).now()"
result="flowScope.currentDate" />
        <evaluate
expression="T(org.joda.time.Minutes).minutesBetween(currentDate.toLocalDateTime(),
expirationDate.toLocalDateTime()).getMinutes()" result="flowScope.dateDiff"
/>
        <evaluate
expression="T(org.slf4j.LoggerFactory).getLogger('net.shibboleth.idp.profile').debug('Time
in minutes to password expiry : ' + dateDiff)" />
    </on-start>

What is the recommended way to deny user login before/after displaying the
respective view ?



On 13 July 2016 at 18:20, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 7/13/16, 8:20 AM, "users on behalf of Prashant Bapat" <
> users-bounces at shibboleth.net on behalf of prashant at apigee.com> wrote:
>
> > I tried to look at the Javadoc but still not able to figure this out.
> I'm not familiar
> > with Java.
>
> Well, that's a problem, obviously.
>
> > How do I get the passwordExpiration attribute from here ?
>
> By accessing the attribute set from the AttributeContext's methods. You
> need to know at least basic Java. I'm sorry, but that's just how it is.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160722/b669a417/attachment.html>