Context Check Intercept (Login Intercept?) for managing account suspensions?

[Wessel, Keith]

That's only a problem if you're counting on your SSO system to communicate to the user that their account his been suspended. I suppose if they can't log into email, you can't use that method. Presumably, you'll want them to contact the help desk, and a scrambled password that they can't use along with the inability for them to change it will probably have that same end result.

Best option is to still disable the account in the authentication store in a way that your LDAP server returns an error code other than "incorrect password". You can then map that error to a message that displays in place of the incorrect username/password message in the IdP without writing a new flow. By doing this, as Scott said, you're preventing logins not just from Shibboleth but from anything else authenticating against that store. And ideally, anything authenticating against that store could display an intelligent message.

If your authentication store can't do that, then yes, you could always create a custom flow that examines some account suspension attribute, but I'd be surprised if any modern LDAP server doesn't have that kind of functionality.

Mappings for the authentication store errors to IdP errors are in the files in conf/authn, and those errors in the IdP can in turn be mapped to messages in the message file that are displayed by the default login-error.vm.

Keith


From: users <users-bounces at shibboleth.net> On Behalf Of Ullfig, Roberto Alfredo
Sent: Thursday, August 29, 2019 8:29 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: Context Check Intercept (Login Intercept?) for managing account suspensions?

That doesn't make much sense to me. How does the authentication service tell the user the account is suspended if the user can't login to it?

---
Roberto Ullfig - rullfig at uic.edu<mailto:rullfig at uic.edu>
Systems Administrator
Enterprise Architecture and Development | ACCC
University of Illinois - Chicago
________________________________
From: users <users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net>> on behalf of Wessel, Keith <kwessel at illinois.edu<mailto:kwessel at illinois.edu>>
Sent: Wednesday, August 28, 2019 12:26 PM
To: Shib Users <users at shibboleth.net<mailto:users at shibboleth.net>>
Subject: RE: Context Check Intercept (Login Intercept?) for managing account suspensions?

Hi, Roberto,

You can do pretty much anything with the flexible flow framework in the IdP (others on this list can coach you better than me on specifics). You might find it simpler, though, to just disable the user's account in your back-end password store or just scramble the password.

Keith


From: users <users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net>> On Behalf Of Ullfig, Roberto Alfredo
Sent: Wednesday, August 28, 2019 11:51 AM
To: users at shibboleth.net<mailto:users at shibboleth.net>
Subject: Context Check Intercept (Login Intercept?) for managing account suspensions?

Hello, we do run openldap but I'm pretty sure we don't support password policy overlays. Can I prevent login (for all relaying parties) for suspended accounts using a Context Check Intercept that checks the value of the user's suspension attribute?

---
Roberto Ullfig - mailto:rullfig at uic.edu
Systems Administrator
Enterprise Architecture and Development | ACCC
University of Illinois - Chicago
--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190829/24874e99/attachment.html>