FreeIPA - Password Expiration

[Prashant Bapat]

When I enabled the intercept flow with a non-proceed event, the user is
displayed a "access denied" view. This also sets the shib_idp_session
cookie. If the user were to visit the IdP page again, it does not show the
login page instead throws an error. I'm assuming this is because the
browser sends the shib_idp_session cookie and IdP tries to get the
authenticationContext which will be "null" because no login page was
displayed and hence no authentication took place.

If I remove the shib_idp_session cookie manually from the browser or from
the flow like I said before, the user is shown the login page which is the
correct behavior.

Hope I'm making sense.

> Do NOT do that. You have no business doing it, and you cannot depend on
anything like that.

I got that part. It does not look right.

Thanks.
--Prashant

On 22 July 2016 at 20:11, Cantor, Scott <cantor.2 at osu.edu> wrote:

> > Do you mean when there is a shib_idp_session cookie which is valid, and
> > user tries to login again ?
>
> I don't know what you're asking. I'm saying attribute resolution is a
> totally separate step and populates a different context. Attributes during
> authentication is a special feature of the LDAP option and is what you're
> using.
>
> > that case right ? This is the reason for my question about the
> recommended
> > way to deny without setting the shib_idp_session cookie. Right now, as
> part
> > of my non-proceed event, I'm explicitly removing the cookie like this ;
>
> Do NOT do that. You have no business doing it, and you cannot depend on
> anything like that.
>
> -- Scott
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160722/ad642dcf/attachment.html>