fail authentication when attribute is not available?

[Peter Schober]

* Olga Terlyga <terlyga at fnal.gov> [2016-11-16 16:53]:
> We are running Shibboleth 3 IdP. Authentication is not ldap, but
> user attributes attributes are pulled from ldap (after successful
> authentication). Right now IdP  considers authentication successful
> even if not all attributes are available, it just releases whatever
> is available. I would like to know how to "fail" authentication when
> any of the attributes are not available.

Attribute resolving literally happens too late to fail authn (whatever
method you're using for authn), but you could still abort the flow if
some attribute are missing, which is essentially what you're after, I
think. The feature you're looking for is called Profile Intercept and
here's an example similar to what you want:
https://wiki.shibboleth.net/confluence/display/IDP30/ContextCheckInterceptConfiguration

HTH,
-peter