FreeIPA - Password Expiration

[Cantor, Scott]

On 7/21/16, 9:15 PM, "users on behalf of Prashant Bapat" <users-bounces at shibboleth.net on behalf of prashant at apigee.com> wrote:

>    Thanks for the pointers. I'm able to modify the expiring-password intercept flow to my
> needs. Something like below works;

That's correct if you're accessing attributes retrieved during authentication, but not for regular attributes.
     
> What is the recommended way to deny user login before/after displaying the respective
> view ? 

https://wiki.shibboleth.net/confluence/display/IDP30/ProfileHandling

See Post-Authentication Intercept Contract

Return a non-proceed event from the flow.

-- Scott