Question about velocity: using VelocityView

[Karla Borecky]

Well, I guess talking to ldap and messing with attributes seemed like much
more comfortable territory to me, since I've really not messed with Java at
all. I mean, I'm a total noob who can only rely on examples to guide me.

I know what you mean about people being fooled into giving out their
passwords by even the most flimsy attempt - I am constantly amazed at what
people will fall for -  but when the phishing uses our actual login images,
that seems a bit too much to expect people to watch out for. I don't know.

Sigh.

On Fri, Oct 14, 2016 at 3:46 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> > But maybe if I set it up so that the ldap server port is only open to my
> IdP to
> > read that attribute, then,,,they couldn't fake it because they couldn't
> see it,
> > right? I have to think about that.
>
> No, they wouldn't have access to your LDAP server anyway.
>
> If you're really worried about people phishing your users, I suspect
> you're spending a lot of time to accomplish very little but your original
> idea is as good as any.
>
> Phishing doesn't require that people spoof your page. Those users will
> hand over their password to anybody for any reason. They simply don't value
> it.
>
> > Can you use the ldap connector to look up a user and read an attribute
> > before the authn completes? (I assume the attribute resolver doesn't
> kick in
> > until the person authenticates.) I mean, it's going to have to find them
> to
> > authenticate them, obviously, but...
>
> No, that's all custom login flow work, way beyond simply coding some Java
> into a template.
>
> -- Scott
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>



-- 
Karla Borecky
Systems Administrator
ITS
Smith College
Northampton, MA 01063
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161014/1514c6ee/attachment.html>