Question about velocity: using VelocityView

[Karla Borecky]

Yes, originally, I thought I could read it from LDAP after the person typed
in their userid, but my colleagues pointed out that anyone could type in
someone's userid, and then it would display the image. Then I thought I
could display if after they verified their username and pw.

But maybe if I set it up so that the ldap server port is only open to my
IdP to read that attribute, then,,,they couldn't fake it because they
couldn't see it, right? I have to think about that.

Can you use the ldap connector to look up a user and read an attribute
before the authn completes? (I assume the attribute resolver doesn't kick
in until the person authenticates.) I mean, it's going to have to find them
to authenticate them, obviously, but...

My head is spinning. :-D


On Fri, Oct 14, 2016 at 3:12 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> > The only other thing I could think to do would be to store something
> generic
> > like a number in the cookie, which would then refer to values stored in
> a local
> > database, but then I have to deal with accessing db tables inside a view,
> > which seems even more complicated.
>
> Normally that is basically an IDM feature, yes, and I would note also that
> the way this works in most systems is in fact to prompt for the username
> first, then display the image on the page asking for the password, so it
> can be looked up from the IDM system. That seems to be the normal model in
> many modern web systems, but universities for whatever reason seem to
> really dislike the splitting of the prompts.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 
Karla Borecky
Systems Administrator
ITS
Smith College
Northampton, MA 01063
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161014/97718785/attachment.html>