Example warning-intercept-config.xml file?

[Waddell, Michael (waddelml)]

Thanks much, that helped a lot! I've got it working in a much more customizable way now.

For those curious, I had previously set up expiring-password-intercept-config.xml pretty much straight out-of-the-box, and my expiring-password.vm pulled in the passwordExpiration value from AttributeContext (via profileRequestContext) and used #if statements to show different content depending on the value. Now, instead, I use a warning-intercept-config.xml file which looks like this:

    <util:map id="shibboleth.warning.ConditionMap">
        <entry key="expired-password">
            <bean parent="shibboleth.Pair">
                <constructor-arg index="0">
                    <bean parent="shibboleth.Conditions.NOT">
                        <constructor-arg>
                            <bean class="net.shibboleth.idp.profile.logic.DateAttributePredicate"
                                c:attribute="passwordExpiration"
                                c:formatString="yyyyMMddHHmmssX"
                                p:resultIfMissing="true"
                                p:offset="-P0D" />
                        </constructor-arg>
                    </bean>
                </constructor-arg>
                <constructor-arg index="1">
                    <bean class="java.time.Duration" factory-method="parse" c:_0="PT0H" />
                </constructor-arg>
            </bean>
        </entry>
        <entry key="expiring-password">
            <bean parent="shibboleth.Pair">
                <constructor-arg index="0">
                    <bean parent="shibboleth.Conditions.NOT">
                        <constructor-arg>
                            <bean class="net.shibboleth.idp.profile.logic.DateAttributePredicate"
                                c:attribute="passwordExpiration"
                                c:formatString="yyyyMMddHHmmssX"
                                p:resultIfMissing="true"
                                p:offset="-P7D" />
                        </constructor-arg>
                    </bean>
                </constructor-arg>
                <constructor-arg index="1">
                    <bean class="java.time.Duration" factory-method="parse" c:_0="PT8H" />
                </constructor-arg>
            </bean>
        </entry>
  </util:map>

There is now different content in expiring-password.vm and expired-password.vm. (The former allows you to continue to your SP if you wish, and the latter forces you to go to password-self-service instead.)

Thanks again,

Michael Waddell
Digital Technology Solutions
University of Cincinnati
he/him/his

-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott via users
Sent: Wednesday, May 10, 2023 1:18 PM
To: Shib Users <users at shibboleth.net>
Cc: Cantor, Scott <cantor.2 at osu.edu>
Subject: Re: Example warning-intercept-config.xml file?

External Email: Use Caution


My warning config for detecting expired passwords is below, but to do "something else also" is just another map entry.

-- Scott

    <util:map id="shibboleth.warning.ConditionMap">
        <entry key="expiring-password">
            <bean parent="shibboleth.Pair">
                <constructor-arg index="0">
                    <bean parent="shibboleth.Conditions.NOT">
                        <constructor-arg>
                            <bean class="net.shibboleth.idp.profile.logic.DateAttributePredicate"
                                c:attribute="passwordExpiration"
                                c:formatString="yyyyMMddHHmmssX"
                                p:resultIfMissing="true"
                                p:offset="-P14D" />
                        </constructor-arg>
                    </bean>
                </constructor-arg>
                <constructor-arg index="1">
                    <bean class="java.time.Duration" factory-method="parse" c:_0="PT8H" />
                </constructor-arg>
            </bean>
        </entry>
  </util:map>

--
For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net