AW: Example warning-intercept-config.xml file?

[Bergmann, Clemens]

Hi,

thanks for the helpful snippet.
I got a request to check the entered password for compliance with a new password policy.
Do you know how I could get the input password into a scripted predicate?

Kind Regards
Clemens

-- 
Clemens Bergmann
Gruppe Nutzermanagement und Entwicklung
Technische Universität Darmstadt
Hochschulrechenzentrum, Alexanderstraße 2, 64283 Darmstadt
Tel. +49 6151 16 71184
http://www.hrz.tu-darmstadt.de/

> -----Ursprüngliche Nachricht-----
> Von: users <users-bounces at shibboleth.net> Im Auftrag von Waddell,
> Michael (waddelml) via users
> Gesendet: Donnerstag, 11. Mai 2023 14:52
> An: Shib Users <users at shibboleth.net>
> Cc: Waddell, Michael (waddelml) <waddelml at ucmail.uc.edu>
> Betreff: RE: Example warning-intercept-config.xml file?
> 
> Thanks much, that helped a lot! I've got it working in a much more
> customizable way now.
> 
> For those curious, I had previously set up expiring-password-intercept-
> config.xml pretty much straight out-of-the-box, and my expiring-
> password.vm pulled in the passwordExpiration value from AttributeContext
> (via profileRequestContext) and used #if statements to show different
> content depending on the value. Now, instead, I use a warning-intercept-
> config.xml file which looks like this:
> 
>     <util:map id="shibboleth.warning.ConditionMap">
>         <entry key="expired-password">
>             <bean parent="shibboleth.Pair">
>                 <constructor-arg index="0">
>                     <bean parent="shibboleth.Conditions.NOT">
>                         <constructor-arg>
>                             <bean
> class="net.shibboleth.idp.profile.logic.DateAttributePredicate"
>                                 c:attribute="passwordExpiration"
>                                 c:formatString="yyyyMMddHHmmssX"
>                                 p:resultIfMissing="true"
>                                 p:offset="-P0D" />
>                         </constructor-arg>
>                     </bean>
>                 </constructor-arg>
>                 <constructor-arg index="1">
>                     <bean class="java.time.Duration" factory-method="parse"
> c:_0="PT0H" />
>                 </constructor-arg>
>             </bean>
>         </entry>
>         <entry key="expiring-password">
>             <bean parent="shibboleth.Pair">
>                 <constructor-arg index="0">
>                     <bean parent="shibboleth.Conditions.NOT">
>                         <constructor-arg>
>                             <bean
> class="net.shibboleth.idp.profile.logic.DateAttributePredicate"
>                                 c:attribute="passwordExpiration"
>                                 c:formatString="yyyyMMddHHmmssX"
>                                 p:resultIfMissing="true"
>                                 p:offset="-P7D" />
>                         </constructor-arg>
>                     </bean>
>                 </constructor-arg>
>                 <constructor-arg index="1">
>                     <bean class="java.time.Duration" factory-method="parse"
> c:_0="PT8H" />
>                 </constructor-arg>
>             </bean>
>         </entry>
>   </util:map>
> 
> There is now different content in expiring-password.vm and expired-
> password.vm. (The former allows you to continue to your SP if you wish, and
> the latter forces you to go to password-self-service instead.)
> 
> Thanks again,
> 
> Michael Waddell
> Digital Technology Solutions
> University of Cincinnati
> he/him/his
> 
> -----Original Message-----
> From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott via
> users
> Sent: Wednesday, May 10, 2023 1:18 PM
> To: Shib Users <users at shibboleth.net>
> Cc: Cantor, Scott <cantor.2 at osu.edu>
> Subject: Re: Example warning-intercept-config.xml file?
> 
> External Email: Use Caution
> 
> 
> My warning config for detecting expired passwords is below, but to do
> "something else also" is just another map entry.
> 
> -- Scott
> 
>     <util:map id="shibboleth.warning.ConditionMap">
>         <entry key="expiring-password">
>             <bean parent="shibboleth.Pair">
>                 <constructor-arg index="0">
>                     <bean parent="shibboleth.Conditions.NOT">
>                         <constructor-arg>
>                             <bean
> class="net.shibboleth.idp.profile.logic.DateAttributePredicate"
>                                 c:attribute="passwordExpiration"
>                                 c:formatString="yyyyMMddHHmmssX"
>                                 p:resultIfMissing="true"
>                                 p:offset="-P14D" />
>                         </constructor-arg>
>                     </bean>
>                 </constructor-arg>
>                 <constructor-arg index="1">
>                     <bean class="java.time.Duration" factory-method="parse"
> c:_0="PT8H" />
>                 </constructor-arg>
>             </bean>
>         </entry>
>   </util:map>
> 
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to users-
> unsubscribe at shibboleth.net
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to users-
> unsubscribe at shibboleth.net