<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<meta content="text/html; charset=UTF-8">
<style type="text/css" style="">
<!--
p
{margin-top:0;
margin-bottom:0}
-->
</style>
<div dir="ltr">
<div id="x_divtagdefaultwrapper" style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
<p>For those looking for a better user experience, the ContextCheckIntercept flow [1] fits the bill for this use case perfectly. In effect, you can enforce rudimentary AuthZ on the IdP side based on the value of a particular attribute or attributes, and route
users to a custom error page on your end.</p>
<p><br>
</p>
<p>This avoids whatever nasty error message an SP might display when not given all the attributes it needs.<br>
</p>
<p><br>
</p>
<p><a href="https://wiki.shibboleth.net/confluence/display/IDP30/ContextCheckInterceptConfiguration" class="x_OWAAutoLink" id="LPlnk347985">https://wiki.shibboleth.net/confluence/display/IDP30/ContextCheckInterceptConfiguration</a><br>
</p>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Klingenstein, Nate <nklingenstein@calstate.edu><br>
<b>Sent:</b> Friday, July 22, 2016 3:20:17 PM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> RE: Box.com Preventing users from logging in</font>
<div> </div>
</div>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">> I imagine Box presents the user with some cryptic "account not found" message, but I haven't tested it recently.<br>
<br>
If you find yourself inspired at any point, there's a paragraph on the second linked page for which that would be(am already detained for bad puns) the perfect predicate.<br>
<br>
"Box does not support an explicit eligibility attribute. Ineligibility can be expressed indirectly by suppressing the release of all attributes to Box when an ineligible user authenticates."<br>
-- <br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font>
</body>
</html>