fail authentication when attribute is not available?

[Klingenstein, Nate]

Olga,

> We use Kerberos for initial authentication, if that changes anything. 

I wouldn't expect it to change anything except that Kerberos would usually try to manage sessions and do SSO, which means failing authentication outright may not even be possible.  If you have any automated authentication, then you definitely just want to fail the request.

I think the intercept is exactly what you're looking for.

Hope this helps,
Nate.