<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
On Apr 17, 2014, at 12:18 PM, Wessel, Keith <<a href="mailto:kwessel@illinois.edu">kwessel@illinois.edu</a>> wrote:<br>
<div><br class="Apple-interchange-newline">
<blockquote type="cite">
<div style="margin: 0in 0in 0.0001pt; font-size: 11pt; font-family: Calibri, sans-serif; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
Is that going to be my best option? Or is there a better way to go? Keep in mind that our password reset page is, in fact, Shibboleth-protected. So, whatever I do would need to not stop the user if the service requesting authentication was the password reset
page.<o:p></o:p></div>
<br class="Apple-interchange-newline">
</blockquote>
</div>
<div><br>
</div>
<div>Having the change password page behind SSO can leave a hole open to the forced password change. User logs in, gets Shib session, directed to change password. Simply ignores it and accesses their original target. Previous session handler sends them to the
original target. Just be aware it's a circumstance you have to allow for.</div>
<div><br>
</div>
<div>Paul</div>
<br>
<div apple-content-edited="true">Paul Hethmon<br>
Chief Software Architect<br>
<a href="mailto:paul.hethmon@clareitysecurity.com">paul.hethmon@clareitysecurity.com</a><br>
<br>
</div>
<br>
</body>
</html>