debugging expiring password intercept

[Brent Putman]

On 6/2/17 8:33 PM, Paul B. Henson wrote:

>
>     <decision-state id="ShouldUnsetCookie">
>     <on-entry>
>         <evaluate expression="T(org.slf4j.LoggerFactory).getLogger('net.shibboleth.idp').debug('entering expiring-password-flow ShouldUnsetCookie')" />
>         <if test="ExpiringPasswordCookieManager.getCookieValue(ExpiringPasswordCookieName, null) != null"
>             then="UnsetCookie" else="proceed" />
>     </decision-state>

May or may not be significant, but unless it's a cut/paste error,
you're missing the closing </on-entry> tag there.  That would make it
not even well-formed XML, and I would think SWF would scream about
that.  (Per below, that would also sort of imply this isn't running)

> However, after authenticating, none of these log messages show up:
>
> # grep expiring-password-flow /opt/shibboleth-idp/logs/idp-process.log
> 2017-06-02 17:13:01,378 - DEBUG [net.shibboleth.idp.profile.spring.factory.FlowDefinitionRegistryFactoryBean:240] - Registered flow ID 'intercept/expiring-password' using 'file [/opt/shibboleth-idp/flows/../system/flows/intercept/expiring-password-flow.xml]'
> 2017-06-02 17:13:01,386 - DEBUG [net.shibboleth.idp.profile.spring.factory.FlowDefinitionRegistryFactoryBean:240] - Registered flow ID 'authn/conditions/expiring-password' using 'file [/opt/shibboleth-idp/flows/authn/conditions/expiring-password/expiring-password-flow.xml]'
>

That certainly implies that that flow isn't even running.


> Also, there are only two cookies from the idp in my browser:
>
> JSESSIONID
> shib_idp_session
>
> The shib_idp_exp_pwd cookie doesn't seem to be getting set 8-/.

That also implies that the flow isn't running. 


>
> I've disabled some of the other things that use intercepts, such as user-level
> attribute consent. Would that somehow cause the password expiration intercept
> not to run?

Well, it doesn't run automatically.  You have to explicitly enable it
on the profile config.  So you'd need something like this on the
relevant profile config (here for SAML 2 SSO):


<bean parent="SAML2.SSO"
p:postAuthenticationFlows="#{{'expiring-password'}}" />


It has to be on the one that is effective for the SP in question, so if
you relying party overrides, you need to factor that in.  Obviously if
you're also doing attribute consent or terms of use, etc, those would
also appear in the list.

Documentation refs:

https://wiki.shibboleth.net/confluence/display/IDP30/ProfileInterceptConfiguration

https://wiki.shibboleth.net/confluence/display/IDP30/ExpiringPasswordInterceptConfiguration




||
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170602/f51ada28/attachment.html>