A bit lost on how tu trigger username-password validation against LDAP in IDPV4

[Claude Libois]

The goal of the custom flow is to provide a choice between 2 authentication:
- external one
- authentication against LDAP with provide credentials.
The same webpage is used to trigger either external authentication either
ldap one.
After LDAP/External authentication, we use an http call to a Rest API to
get information about username and so populate saml response through
attribute-resolver mechanism.

To achieve this, we didn't tweak completely the current file but added some
custom flow that are very similar to the existing one:
We got a xxx-particulier-ldap-authn-config.xml and
a xxx-particulier-password-authn-config.xml nearly identical to
the ldap-authn-config.xml and password-authn-config.xml.
We have got a specific spring webflow for this auth flow. This is this flow
which is using the
 <evaluate expression="ValidateUsernamePassword" />  which is mapped to
the   ValidateUsernamePasswordAgainstLDAP in IDP3.
I'm not sure if it was really needed to redefine the whole flow or if we
could have just tweaked the existing one.
Regards,
Claude


Le mer. 5 mai 2021 à 15:21, Cantor, Scott <cantor.2 at osu.edu> a écrit :

> On 5/5/21, 9:11 AM, "users on behalf of Claude Libois" <
> users-bounces at shibboleth.net on behalf of clibois.work at gmail.com> wrote:
>
> >    If I do understand you, it's never been a good practice to create its
> own authentication flow(with it's own
> > spring webflow) such as in our current idp configuration.
>
> You can, but you can't do it by copying ours without it breaking, which is
> why it broke.
>
> >    I should only enable authentication flow in general-authn.xml by
> adding/removing flow in <util:list
> > id="shibboleth.AvailableAuthenticationFlows"> ?
>
> That's itself obsolete information in 4.1 but the Authentication topic
> discusses doing extensions of this sort and how to register them.
>
> >    Am I right ?
>
> More or less but if you tell me what the actual goal of the custom flow
> was then it's easier to give a general pointer.
>
> -- Scott
>
>
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210505/04875938/attachment.htm>