FreeIPA - Password Expiration

[Prashant Bapat]

Scott,

Thanks for your patience on this. Much appreciated.

Let me try and explain what I'm trying to achieve.

I want the user to be denied login if the krbPasswordExpiration attribute
returned from LDAP is in the past, i.e the password has expired. The user
should be informed of this.

I'm doing something like below.

   <action-state id="getPasswordExpiryFromLdap">
        <on-entry>
        <evaluate
expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext))"
result="flowScope.authenticationContext" />
        <evaluate
expression="flowScope.authenticationContext.getSubcontext(T(net.shibboleth.idp.authn.context.LDAPResponseContext))"
result="flowScope.ldapResponseContext" />
        <evaluate
expression="ldapResponseContext.getAuthenticationResponse()"
result="flowScope.authResponse" />
        <evaluate
expression="authResponse.getLdapEntry().getAttribute('krbPasswordExpiration').getStringValue()"
result="flowScope.expirationDateString" />
        <evaluate
expression="T(org.slf4j.LoggerFactory).getLogger('net.shibboleth.idp.profile').debug(expirationDateString)"
/>
        <evaluate
expression="T(org.joda.time.DateTime).parse(expirationDateString,
T(org.joda.time.format.DateTimeFormat).forPattern("yyyyMMddHHmmss'Z'"))"
result="flowScope.expirationDate" />
        <evaluate expression="T(org.joda.time.DateTime).now()"
result="flowScope.currentDate" />
        <evaluate
expression="T(org.joda.time.Minutes).minutesBetween(currentDate.toLocalDateTime(),
expirationDate.toLocalDateTime()).getMinutes()" result="flowScope.dateDiff"
/>
        <evaluate
expression="T(org.slf4j.LoggerFactory).getLogger('net.shibboleth.idp.profile').debug('Time
in minutes to password expiry : ' + dateDiff)" />
        </on-entry>
        <evaluate
expression="T(org.slf4j.LoggerFactory).getLogger('net.shibboleth.idp.profile').debug('Going
to check if password is expired.')" />
        <transition to="CheckIfPasswordIsExpired" />
   </action-state>

    <decision-state id="CheckIfPasswordIsExpired">
        <if test="(flowScope.dateDiff le 0)"
            then="DisplayIPAPasswordExpiredView"
            else="proceed" />
    </decision-state>

    <view-state id="DisplayIPAPasswordExpiredView"
view="freeipa-password-expired">
        <on-render>
            <evaluate expression="environment"
result="viewScope.environment" />
            <evaluate
expression="flowRequestContext.getExternalContext().getNativeRequest()"
result="viewScope.request" />
            <evaluate
expression="flowRequestContext.getExternalContext().getNativeResponse()"
result="viewScope.response" />
            <evaluate
expression="T(net.shibboleth.utilities.java.support.codec.HTMLEncoder)"
result="viewScope.encoder" />
            <evaluate
expression="flowRequestContext.getActiveFlow().getApplicationContext().containsBean('shibboleth.CustomViewContext')
?
flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.CustomViewContext')
: null" result="viewScope.custom" />
        </on-render>

        <transition to="proceed" />
    </view-state>

This works so far. If the password has expired, freeipa-password-expired
view is displayed.

Problem is when the user goes to the SP again in a short time and then gets
redirected to IdP, because of the shib_idp_session cookie, authentication
does not take place and
"net.shibboleth.idp.authn.context.AuthenticationContext"
will be "null" and hence I get an exception like below.

2016-07-22 17:08:24,474 - ERROR [net.shibboleth.idp.profile.interceptor:-2]
- Uncaught runtime exception
org.springframework.binding.expression.EvaluationException: An ELException
occurred getting the value for expression
'ldapResponseContext.getAuthenticationResponse()' on context [class
org.springframework.webflow.engine.impl.RequestControlContextImpl]
        at
org.springframework.binding.expression.spel.SpringELExpression.getValue(SpringELExpression.java:92)
Caused by: org.springframework.expression.spel.SpelEvaluationException:
EL1011E:(pos 20): Method call: Attempted to call method
getAuthenticationResponse() on null context object
        at
org.springframework.expression.spel.ast.MethodReference.throwIfNotNullSafe(MethodReference.java:144)

Thanks.
--Prashant


On 22 July 2016 at 21:33, Cantor, Scott <cantor.2 at osu.edu> wrote:

> > When I enabled the intercept flow with a non-proceed event, the user is
> > displayed a "access denied" view. This also sets the shib_idp_session
> cookie.
>
> That is not an API, it's not public. If there's some problem, then maybe
> whatever you're trying to do can't be done or has to be done some other
> way, but working around that with the cookie is not allowed. You have not
> made it clear what you're trying to do or what you want to happen.
>
> If you're trying to retroactively prevent the memory of a login, that is
> not a supported feature. Once you're this far, that's already happened. You
> shouldn't be letting authentication succeed if you need it to, well, not
> succeed. That is not a valid use of the interceptors. All you can do here
> is prevent a specific request to an SP from completing.
>
> > If the user were to visit the IdP page again, it does not show the login
> page
> > instead throws an error.
>
> There is no "IdP page" to visit, nor do I know what "error" means.
>
> > Hope I'm making sense.
>
> Not really, and I don't know what you're actually trying to do here to
> begin with.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160722/830889ec/attachment-0001.html>