AW: Example warning-intercept-config.xml file?

[Bergmann, Clemens]

Hi Scott,

thanks for your feedback. 
You are correct that enforcement of a password should be (and in our case is) part of the password change process.
But our password policy does not enforce a regular password change. We want to notify the user upon login that the current password could be used but should be changed to comply with the current password policy.
The only other option is to force all users to change the password as we have not means to see if the password of a user complies with the current password policy.
I iterated over every subcontext of profileRequestContext and could not find the password there. I think it would be an option to put it there and then take and remove it later.
Can you think of a good spot to hook into to save the password temporarily?

Kind regards,
Clemens

-- 
Clemens Bergmann
Gruppe Nutzermanagement und Entwicklung
Technische Universität Darmstadt
Hochschulrechenzentrum, Alexanderstraße 2, 64283 Darmstadt
Tel. +49 6151 16 71184
http://www.hrz.tu-darmstadt.de/

> -----Ursprüngliche Nachricht-----
> Von: users <users-bounces at shibboleth.net> Im Auftrag von Cantor, Scott
> via users
> Gesendet: Donnerstag, 11. Mai 2023 17:09
> An: Shib Users <users at shibboleth.net>
> Cc: Cantor, Scott <cantor.2 at osu.edu>
> Betreff: Re: Example warning-intercept-config.xml file?
> 
> > Do you know how I could get the input password into a scripted predicate?
> 
> That's not a typical use of the feature, and this is a password (by this point)
> that would have already worked. If you really wanted to trap it and do
> something, it's probably possible, but that's something the password change
> process should deal with.
> 
> -- Scott
> 
> 
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to users-
> unsubscribe at shibboleth.net