FreeIPA - Password Expiration

[Prashant Bapat]

> That's correct if you're accessing attributes retrieved during
authentication, but not for regular attributes.

Do you mean when there is a shib_idp_session cookie which is valid, and
user tries to login again ? The net.shibboleth.idp.authn.context.
AuthenticationContext would be 'null' in that case right ? This is the
reason for my question about the recommended way to deny without setting
the shib_idp_session cookie. Right now, as part of my non-proceed event,
I'm explicitly removing the cookie like this ;

    <action-state id="RemoveShibSessionCookie">
        <evaluate
expression="ExpiringPasswordCookieManager.unsetCookie('shib_idp_session')"
/>
        <evaluate
expression="ExpiringPasswordCookieManager.unsetCookie('shib_idp_session_ss')"
/>
        <transition to="DisplayIPAPasswordExpiredView" />
    </action-state>

This does not look elegant although it does the job.

Thanks.
--Prashant

On 22 July 2016 at 07:02, Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 7/21/16, 9:15 PM, "users on behalf of Prashant Bapat" <
> users-bounces at shibboleth.net on behalf of prashant at apigee.com> wrote:
>
> >    Thanks for the pointers. I'm able to modify the expiring-password
> intercept flow to my
> > needs. Something like below works;
>
> That's correct if you're accessing attributes retrieved during
> authentication, but not for regular attributes.
>
> > What is the recommended way to deny user login before/after displaying
> the respective
> > view ?
>
> https://wiki.shibboleth.net/confluence/display/IDP30/ProfileHandling
>
> See Post-Authentication Intercept Contract
>
> Return a non-proceed event from the flow.
>
> -- Scott
>
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160722/a8c42ad9/attachment.html>