Box.com Preventing users from logging in

[Domingues, Michael D]

For those looking for a better user experience, the ContextCheckIntercept flow [1] fits the bill for this use case perfectly. In effect, you can enforce rudimentary AuthZ on the IdP side based on the value of a particular attribute or attributes, and route users to a custom error page on your end.


This avoids whatever nasty error message an SP might display when not given all the attributes it needs.


https://wiki.shibboleth.net/confluence/display/IDP30/ContextCheckInterceptConfiguration

________________________________
From: users <users-bounces at shibboleth.net> on behalf of Klingenstein, Nate <nklingenstein at calstate.edu>
Sent: Friday, July 22, 2016 3:20:17 PM
To: Shib Users
Subject: RE: Box.com Preventing users from logging in

> I imagine Box presents the user with some cryptic "account not found" message, but I haven't tested it recently.

If you find yourself inspired at any point, there's a paragraph on the second linked page for which that would be(am already detained for bad puns) the perfect predicate.

"Box does not support an explicit eligibility attribute. Ineligibility can be expressed indirectly by suppressing the release of all attributes to Box when an ineligible user authenticates."
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160722/61ce6695/attachment.html>