Modifying Login Flows

[Mr. Christopher Bland]

Hi Scott,

Got it, I missed one of the mistyped characters.  Thank you for all of the help

For anyone that reads this in the future here’s what I did.

Created custom view fduchangedpassword.vm

I edited conf/authn/password-authn-config.xml creating an error code for the error condition(s) I wanted to catch

I wanted AD user must change password on next login and AD password expired

        <entry key="FDUExpiredPassword">
            <list>
                <value>ERROR_PASSWORD_EXPIRED</value>
                <value>ERROR_PASSWORD_MUST_CHANGE</value>
                <value>PASSWORD_EXPIRED</value>
                <value>PASSWORD_MUST_CHANGE</value>
                <value>532</value>
                <value>773</value>
            </list>
        </entry>

I edited flows/authn/conditions/conditions-flow.xml to break out of ValidateUsernamePassword and handle my custom condition

    <action-state id="ValidateUsernamePassword">
        <transition on=“FDUExpiredPassword" to="FDUExpiredPasswordError" />
        <transition on="AccountWarning" to="CallExpiringPassword" />
        <transition on="ExpiringPassword" to="CallExpiringPassword" />
        <transition on="ExpiredPassword" to="CallExpiredPassword" />
        <transition on="AccountLocked" to="CallAccountLocked" />
        <transition to="DisplayUsernamePasswordPage" />
    </action-state>

I edited conf/authn/authn-events-flow.xml as outlined in https://wiki.shibboleth.net/confluence/display/IDP30/AuthenticationConfiguration#AuthenticationConfiguration-CustomEvents

    <end-state id="FDUExpiredPasswordError" />

    <global-transitions>
        <transition on="FDUExpiredPasswordError" to=“FDUExpiredPasswordError" />
        <transition on="#{!'proceed'.equals(currentEvent.id<http://currentEvent.id>)}" to="InvalidEvent" />
    </global-transitions>

I edited conf/errors.xml to tell theIDP which view to display and to handle locally as outlined in https://wiki.shibboleth.net/confluence/display/IDP30/ErrorHandlingConfiguration#ErrorHandlingConfiguration-EventCategorization

    <util:map id="shibboleth.EventViewMap">
             <entry key=“FDUExpiredPasswordError" value="fduchangedpassword" />
    </util:map>

    <util:map id="shibboleth.LocalEventMap">
        <entry key="FDUExpiredPasswordError'" value="true" />
        ...
    </util:map>

-Chris

On Jan 30, 2019, at 9:40 PM, Mr. Christopher Bland <chris at fdu.edu<mailto:chris at fdu.edu>> wrote:

Hi Scott,

Even closer now.  Not sure how you saw the extra characters but definitely part of the problem.  I fixed the mistyped characters and now I have fixed my IDP so well it goes back to the SP with an error message instead of displaying my error page.

2019-01-30 21:32:01,828 - 132.238.11.244 - WARN [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event occurred while processing the request: FDUExpiredPasswordError
2019-01-30 21:32:01,998 - 132.238.11.244 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:179] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.messaging.handler.impl.BasicMessageHandlerChain' on OUTBOUND message context
2019-01-30 21:32:01,999 - 132.238.11.244 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:195] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.ResponseImpl'
2019-01-30 21:32:02,022 - 132.238.11.244 - DEBUG [net.shibboleth.idp.saml.profile.impl.SpringAwareMessageEncoderFactory:100] - Looking up message encoder based on binding URI: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST

I thought maybe I mixed up the true/false for local events in conf/errors.xml

    <util:map id="shibboleth.LocalEventMap">
        <entry key="FDUExpiredPasswordError'" value="true" />
        ...
    </util:map>

I switched false to true and still got the same results

-Chris

On Jan 30, 2019, at 8:48 PM, Cantor, Scott <cantor.2 at osu.edu<mailto:cantor.2 at osu.edu>> wrote:

On 1/30/19, 8:39 PM, "users on behalf of Mr. Christopher Bland" <users-bounces at shibboleth.net<mailto:users-bounces at shibboleth.net> on behalf of chris at fdu.edu<mailto:chris at fdu.edu>> wrote:

This doesn’t make sense because the state id it’s looking for is in the list of known state id’s

Yes. That means "facts not in evidence", so we're talking hidden characters, a mistyped character somewhere, etc. Eyeballing, I think you have an extra single quote inside the double quote in a bunch of those event expressions.

-- Scott


--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190131/6e6cbc23/attachment.html>