debugging expiring password intercept

[Paul B. Henson]

On Fri, Jun 02, 2017 at 01:21:01PM +0000, Cantor, Scott wrote:

> Aside from trying to see what it's doing with webflow logs, which are
> pretty hard to follow, adding something like this to various
> <action-state> elements would usually provide a hint.

Hmm, well, I updated expiring-password-flow.xml and added some
debugging:

    <decision-state id="CheckContext">
    <on-entry>
        <evaluate expression="T(org.slf4j.LoggerFactory).getLogger('net.shibboleth.idp').debug('entering expiring-password-flow CheckContext')" />
    </on-entry>
        <if test="ExpiringPasswordPredicate.apply(opensamlProfileRequestContext)"
            then="ShouldUnsetCookie" else="CheckCookie" />
    </decision-state>

    <decision-state id="ShouldUnsetCookie">
    <on-entry>
        <evaluate expression="T(org.slf4j.LoggerFactory).getLogger('net.shibboleth.idp').debug('entering expiring-password-flow ShouldUnsetCookie')" />
        <if test="ExpiringPasswordCookieManager.getCookieValue(ExpiringPasswordCookieName, null) != null"
            then="UnsetCookie" else="proceed" />
    </decision-state>

    <decision-state id="CheckCookie">
    <on-entry>
        <evaluate expression="T(org.slf4j.LoggerFactory).getLogger('net.shibboleth.idp').debug('entering expiring-password-flow CheckCookie')" />
    </on-entry>
        <if test="T(java.lang.System).currentTimeMillis() - T(java.lang.Long).parseLong(ExpiringPasswordCookieManager.getCookieValue(ExpiringPasswordCookieName, '0')) > ExpiringPasswordNotifyInterval"
            then="DisplayExpiringPasswordView" else="proceed" />
    </decision-state>

However, after authenticating, none of these log messages show up:

# grep expiring-password-flow /opt/shibboleth-idp/logs/idp-process.log
2017-06-02 17:13:01,378 - DEBUG [net.shibboleth.idp.profile.spring.factory.FlowDefinitionRegistryFactoryBean:240] - Registered flow ID 'intercept/expiring-password' using 'file [/opt/shibboleth-idp/flows/../system/flows/intercept/expiring-password-flow.xml]'
2017-06-02 17:13:01,386 - DEBUG [net.shibboleth.idp.profile.spring.factory.FlowDefinitionRegistryFactoryBean:240] - Registered flow ID 'authn/conditions/expiring-password' using 'file [/opt/shibboleth-idp/flows/authn/conditions/expiring-password/expiring-password-flow.xml]'


Also, there are only two cookies from the idp in my browser:

JSESSIONID
shib_idp_session

The shib_idp_exp_pwd cookie doesn't seem to be getting set 8-/.

I've disabled some of the other things that use intercepts, such as user-level
attribute consent. Would that somehow cause the password expiration intercept
not to run? Or is there any other change I might have made that would cause
it to be skipped? What should be calling it, so I can start adding
debugging higher up the tree <sigh>?

Thanks...

-- 
Paul B. Henson  |  (909) 979-6361  |  http://www.cpp.edu/~henson/
Operating Systems and Network Analyst  |  henson at cpp.edu
California State Polytechnic University  |  Pomona CA 91768