Modifying Login Flows

[Mr. Christopher Bland]

Hi Scott,

Still not working.  I updated conf/authn/password-authn-config.xml to FDUExpiredPassword to be consistent.  I also added the transition to flows/authn/conditions/conditions-flow.xml inside

    <action-state id="ValidateUsernamePassword">

        <!-- Call outs for exceptional conditions. -->
	<transition on="FDUExpiredPassword " to="FDUExpiredPassword " />
        <transition on="AccountWarning" to="CallExpiringPassword" />
        <transition on="ExpiringPassword" to="CallExpiringPassword" />
        <transition on="ExpiredPassword" to="CallExpiredPassword" />
        <transition on="AccountLocked" to="CallAccountLocked" />
        <transition to="DisplayUsernamePasswordPage" />
    </action-state>

I also noticed I am getting an error not in catalina.out 

SEVERE: For security constraints with URL pattern [/*] only the HTTP methods [TRACE DELETE OPTIONS PUT PATCH] are covered. All other methods are uncovered.
Jan 29, 2019 8:08:21 PM org.apache.catalina.session.StandardSession doReadObject
WARNING: Cannot deserialize session attribute [webflowConversationContainer] for session [866E1506430B3FD73438B663EEA3D9AD]
Jan 29, 2019 8:08:21 PM org.apache.catalina.session.StandardManager startInternal
SEVERE: Exception loading sessions from persistent storage
java.lang.ClassCastException: java.io.ObjectStreamClass cannot be cast to java.lang.String
	at java.io.ObjectInputStream.readTypeString(ObjectInputStream.java:1650)
	at java.io.ObjectStreamClass.readNonProxy(ObjectStreamClass.java:803)
	at java.io.ObjectInputStream.readClassDescriptor(ObjectInputStream.java:891)
	at java.io.ObjectInputStream.readNonProxyDesc(ObjectInputStream.java:1857)
	at java.io.ObjectInputStream.readClassDesc(ObjectInputStream.java:1751)
	at java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2042)
	at java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1573)
	at java.io.ObjectInputStream.defaultReadFields(ObjectInputStream.java:2287)

Just noticed it so I’m not 100% sure if it’s related

-Chris

> On Jan 29, 2019, at 7:59 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> 
> On 1/29/19, 7:44 PM, "users on behalf of Mr. Christopher Bland" <users-bounces at shibboleth.net on behalf of chris at fdu.edu> wrote:
>> I am clearly missing something. 
> 
> "FDUExpiredPassword" and "FDUChangePassword" aren't the same string, and not the same event. That doesn't line up.
> 
> But I think you're correct that for this to work you have to add a transition in conditions-flow.xml to map whichever of those two events you really want to be using to itself as a state transition. The system is designed to trap every event on the login form because I can't really understand how it makes sense to do anything else. Every system I've ever used works that way.
> 
> But if you want to really fail out, you'd have to add <transition on=" FDUExpiredPassword " to=" FDUExpiredPassword " /> to the ValidateUsernamePassword action-state in that file so it will go ahead and forward out that event. The other changes should be sufficient to make that bubble out the rest of the way. But the event names do have to line up everywhere, you can't use one in the message mapping bean and another in the rest of the changes.
> 
> -- Scott
> 
> 
> -- 
> For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net