FreeIPA - Password Expiration

[Cantor, Scott]

> When I enabled the intercept flow with a non-proceed event, the user is
> displayed a "access denied" view. This also sets the shib_idp_session cookie.

That is not an API, it's not public. If there's some problem, then maybe whatever you're trying to do can't be done or has to be done some other way, but working around that with the cookie is not allowed. You have not made it clear what you're trying to do or what you want to happen.

If you're trying to retroactively prevent the memory of a login, that is not a supported feature. Once you're this far, that's already happened. You shouldn't be letting authentication succeed if you need it to, well, not succeed. That is not a valid use of the interceptors. All you can do here is prevent a specific request to an SP from completing.

> If the user were to visit the IdP page again, it does not show the login page
> instead throws an error.

There is no "IdP page" to visit, nor do I know what "error" means.

> Hope I'm making sense.

Not really, and I don't know what you're actually trying to do here to begin with.

-- Scott