allow expired passwords for specific SP

Tue Apr 6 23:52:17 UTC 2021

We have a self-service tool that allows users to change their own password.  Currently, it performs its own LDAP and Duo (web sdk) authentication.  When a user's password is expired, it can detect the specific LDAP error code (auth succeeded but password was expired) and allow them to continue into the application to change their password.

It would be great to let this application use our IDP instead of handling its own authentication.  Is it possible to do this with the IDP?

I know how to detect an expired password (we already display a custom error message for this event), but I don't know how to let authentication proceed.  Of course, we only want to allow this for a specific relying party, and we don't want an SSO session established either.

Are there enough hooks in the IDP to accomplish this?  Has anyone done it before?

Thanks,
Andy
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210406/def984f9/attachment.htm>