<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>
<div>
<p style="box-sizing: border-box; margin-top: 0px; margin-bottom: 16px; color: rgb(51, 51, 51); font-family: 'Helvetica Neue', Helvetica, 'Segoe UI', Arial, freesans, sans-serif; line-height: 22.3999996185303px; widows: 1; background-color: rgb(255, 255, 255);">
(FYI, I’ve created an issue in Github but I wanted to make sure any others who have implemented the MCB recently are aware of this.)</p>
</div>
<div>
<div id=""></div>
</div>
<p style="box-sizing: border-box; margin-bottom: 16px; color: rgb(51, 51, 51); font-family: 'Helvetica Neue', Helvetica, 'Segoe UI', Arial, freesans, sans-serif; line-height: 22.3999996185303px; widows: 1; background-color: rgb(255, 255, 255); margin-top: 0px !important;">
We have had reports from several users who are unable to login to our Shibboleth server after implementing the MCB plugin to the IdP. After severals days of troubleshooting, I lucked into the solution when one of our help desk staff (against policy but I’m
glad they did!) added the user's password to their support ticket. The password has a space at the end, which is allowed by our password policy (it's actually a passphrase policy, which allows spaces). I replicated the conditions for this user by taking a
test account and attempting to login with a passphrase that has no whitespace at either end and again after changing to a passphrase with a space character at the end. The second test failed, which led me to look at the source for both the IdP and the MCB.</p>
<p style="box-sizing: border-box; margin-top: 0px; margin-bottom: 16px; color: rgb(51, 51, 51); font-family: 'Helvetica Neue', Helvetica, 'Segoe UI', Arial, freesans, sans-serif; line-height: 22.3999996185303px; widows: 1; background-color: rgb(255, 255, 255);">
The default behavior of the IdP is to pass the user's password as-is to the authentication source, but the MCB runs it through the DatatypeHelper.safeTrimOrNullString() method first, which strips whitespace off of the beginning or end of the password.</p>
<p style="box-sizing: border-box; margin-top: 0px; margin-bottom: 16px; color: rgb(51, 51, 51); font-family: 'Helvetica Neue', Helvetica, 'Segoe UI', Arial, freesans, sans-serif; line-height: 22.3999996185303px; widows: 1; background-color: rgb(255, 255, 255);">
Luckily we are in the middle of the Summer, but as the Fall starts we will probably run into many more users with this issue.</p>
</div>
<div>
<div id="MAC_OUTLOOK_SIGNATURE">
<div>Thanks,</div>
<div>Mark</div>
<div><br>
</div>
<div>---</div>
<div>Mark McCoy</div>
<div>Identity Management</div>
<div>The University of Texas at San Antonio</div>
<div>210-458-5871</div>
<br>
</div>
</div>
</body>
</html>