authn eDirectory LDAP and grace logins

[Cantor, Scott]

> Is there a way to check the graceLogin attribute when I receive the
> invalid_credentials message from ValidateUsernamePassword?

Not automatically, I don't think. I assume specifying that attribute as one of the attributes to fetch during authentication doesn't produce it in the case you're talking about, but I don't know that. If it did, it would be buried inside the LDAP response objects I guess.

Assuming that's not the case, then it's technically possible, but not built in. You would have to leverage the conditions feature that lets you inject a custom webflow into the midst of responding to one of the mapped events. By default they're just routing back to the Display view-action in the password flow to re-render the view.

If you look at flows/authn/conditions, that's where all this exposed machinery is placed to let people create their own flows and have them invoked when events occur. So partly it's just authoring something there.

But to do something like leverage the implementation's low level classes to resolve attributes, that's not simple (for anybody not versed in the code) and is not documented.

One of the MFA-motivated additions is going to be a "utility" flow to resolve attributes so that we can give people a callable subroutine of sorts to resolve attributes in the middle of basically whatever they're up to and provide it as an API. But that's not there now. We just have the ResolveAttributes action bean that you have to wire into a flow yourself. Again, not that hard if you're familiar, but totally opaque otherwise.

-- Scott