Intercept flows and adjustable auth levels

[Rich Graves]

If all you want is to deny access to any SP other than your password-change
SP, you can do that within relying-party.xml. Make an expired-password flow
with activation condition some ldap or scripted attribute. Add to
DefaultRelyingParty's postAuthenticationFlows. Omit from the stanza for
your special SP.

<bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty">
  <property name="profileConfigurations">
    <list>
      <!--
https://wiki.shibboleth.net/confluence/display/IDP30/ConsentConfiguration#ConsentConfiguration-DisablingAttributeReleaseConsent
-->
      <bean parent="SAML2.SSO"
p:postAuthenticationFlows="expired-password,expiring-password,require-challenge-questions,local-motd-context-check,attribute-release"

and so on.

Oh, but then your users will have to enter username/password twice (once on
the site they wanted, where login will fail, then follow link to the
whitelisted SP where authentication will succeed). I can see that being
unacceptable to some.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160628/835b065e/attachment.html>