Question about velocity: using VelocityView

[Cantor, Scott]

> But maybe if I set it up so that the ldap server port is only open to my IdP to
> read that attribute, then,,,they couldn't fake it because they couldn't see it,
> right? I have to think about that.

No, they wouldn't have access to your LDAP server anyway.

If you're really worried about people phishing your users, I suspect you're spending a lot of time to accomplish very little but your original idea is as good as any.

Phishing doesn't require that people spoof your page. Those users will hand over their password to anybody for any reason. They simply don't value it.

> Can you use the ldap connector to look up a user and read an attribute
> before the authn completes? (I assume the attribute resolver doesn't kick in
> until the person authenticates.) I mean, it's going to have to find them to
> authenticate them, obviously, but...

No, that's all custom login flow work, way beyond simply coding some Java into a template.

-- Scott