allow expired passwords for specific SP

[Cantor, Scott]

On 4/6/21, 7:52 PM, "users on behalf of Andrew Jason Morgan" <users-bounces at shibboleth.net on behalf of morgan at oregonstate.edu> wrote:

>    It would be great to let this application use our IDP instead of handling its own authentication.  Is it possible
> to do this with the IDP?

I just more or less answered this I guess, but the IdP doesn't do things like this out of the box. It just succeeds or fails, LDAP works or not. Doing these extra checks for "success, but..." is an added layer, and no, it's not SP-specific unless you built some pretty crazy custom ldaptive response handling object that's also IdP-aware to be able to examine the other state.

>    I know how to detect an expired password (we already display a custom error message for this event), but I
> don't know how to let authentication proceed.  Of course, we only want to allow this for a specific relying
> party, and we don't want an SSO session established either.
>
>    Are there enough hooks in the IDP to accomplish this?  Has anyone done it before?

It isn't obvious to me how to do it. Anything's possible but this is pushing it. There's no support after authentication for preventing sessions from being created, only preventing caching the authentication while it's being completed. You can't do that after, only during.

Why not just fail and customize the error message in the login view to link out with target="_blank" to a password change page? That seems a lot simpler to me.

-- Scott