<div dir="ltr"><div class="gmail_default" style="font-family:"trebuchet ms",sans-serif">Scott,</div><div class="gmail_default" style="font-family:"trebuchet ms",sans-serif"><br></div><div class="gmail_default" style="font-family:"trebuchet ms",sans-serif">Thanks for your patience on this. Much appreciated. </div><div class="gmail_default" style="font-family:"trebuchet ms",sans-serif"><br></div><div class="gmail_default" style="font-family:"trebuchet ms",sans-serif">Let me try and explain what I'm trying to achieve. </div><div class="gmail_default" style="font-family:"trebuchet ms",sans-serif"><br></div><div class="gmail_default" style="font-family:"trebuchet ms",sans-serif">I want the user to be denied login if the krbPasswordExpiration attribute returned from LDAP is in the past, i.e the password has expired. The user should be informed of this. </div><div class="gmail_default" style="font-family:"trebuchet ms",sans-serif"><br></div><div class="gmail_default" style="font-family:"trebuchet ms",sans-serif">I'm doing something like below. </div><div class="gmail_default" style="font-family:"trebuchet ms",sans-serif"><br></div><div class="gmail_default" style=""><div class="gmail_default" style=""><font face="trebuchet ms, sans-serif"> <action-state id="getPasswordExpiryFromLdap"></font></div><div class="gmail_default" style=""><font face="trebuchet ms, sans-serif"> <on-entry></font></div><div class="gmail_default" style=""><font face="trebuchet ms, sans-serif"> <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext))" result="flowScope.authenticationContext" /></font></div><div class="gmail_default" style=""><font face="trebuchet ms, sans-serif"> <evaluate expression="flowScope.authenticationContext.getSubcontext(T(net.shibboleth.idp.authn.context.LDAPResponseContext))" result="flowScope.ldapResponseContext" /></font></div><div class="gmail_default" style=""><font face="trebuchet ms, sans-serif"> <evaluate expression="ldapResponseContext.getAuthenticationResponse()" result="flowScope.authResponse" /></font></div><div class="gmail_default" style=""><font face="trebuchet ms, sans-serif"> <evaluate expression="authResponse.getLdapEntry().getAttribute('krbPasswordExpiration').getStringValue()" result="flowScope.expirationDateString" /></font></div><div class="gmail_default" style=""><font face="trebuchet ms, sans-serif"> <evaluate expression="T(org.slf4j.LoggerFactory).getLogger('net.shibboleth.idp.profile').debug(expirationDateString)" /></font></div><div class="gmail_default" style=""><font face="trebuchet ms, sans-serif"> <evaluate expression="T(org.joda.time.DateTime).parse(expirationDateString, T(org.joda.time.format.DateTimeFormat).forPattern("yyyyMMddHHmmss'Z'"))" result="flowScope.expirationDate" /></font></div><div class="gmail_default" style=""><font face="trebuchet ms, sans-serif"> <evaluate expression="T(org.joda.time.DateTime).now()" result="flowScope.currentDate" /></font></div><div class="gmail_default" style=""><font face="trebuchet ms, sans-serif"> <evaluate expression="T(org.joda.time.Minutes).minutesBetween(currentDate.toLocalDateTime(), expirationDate.toLocalDateTime()).getMinutes()" result="flowScope.dateDiff" /></font></div><div class="gmail_default" style=""><font face="trebuchet ms, sans-serif"> <evaluate expression="T(org.slf4j.LoggerFactory).getLogger('net.shibboleth.idp.profile').debug('Time in minutes to password expiry : ' + dateDiff)" /></font></div><div class="gmail_default" style=""><font face="trebuchet ms, sans-serif"> </on-entry></font></div><div class="gmail_default" style=""><font face="trebuchet ms, sans-serif"> <evaluate expression="T(org.slf4j.LoggerFactory).getLogger('net.shibboleth.idp.profile').debug('Going to check if password is expired.')" /></font></div><div class="gmail_default" style=""><font face="trebuchet ms, sans-serif"> <transition to="CheckIfPasswordIsExpired" /></font></div><div class="gmail_default" style=""><font face="trebuchet ms, sans-serif"> </action-state></font></div><div class="gmail_default" style=""><font face="trebuchet ms, sans-serif"><br></font></div><div class="gmail_default" style=""><font face="trebuchet ms, sans-serif"> <decision-state id="CheckIfPasswordIsExpired"></font></div><div class="gmail_default" style=""><font face="trebuchet ms, sans-serif"> <if test="(flowScope.dateDiff le 0)"</font></div><div class="gmail_default" style=""><font face="trebuchet ms, sans-serif"> then="DisplayIPAPasswordExpiredView"</font></div><div class="gmail_default" style=""><font face="trebuchet ms, sans-serif"> else="proceed" /></font></div><div class="gmail_default" style=""><font face="trebuchet ms, sans-serif"> </decision-state></font></div><div class="gmail_default" style=""><font face="trebuchet ms, sans-serif"><br></font></div><div class="gmail_default" style=""><font face="trebuchet ms, sans-serif"> <view-state id="DisplayIPAPasswordExpiredView" view="freeipa-password-expired"></font></div><div class="gmail_default" style=""><font face="trebuchet ms, sans-serif"> <on-render></font></div><div class="gmail_default" style=""><font face="trebuchet ms, sans-serif"> <evaluate expression="environment" result="viewScope.environment" /></font></div><div class="gmail_default" style=""><font face="trebuchet ms, sans-serif"> <evaluate expression="flowRequestContext.getExternalContext().getNativeRequest()" result="viewScope.request" /></font></div><div class="gmail_default" style=""><font face="trebuchet ms, sans-serif"> <evaluate expression="flowRequestContext.getExternalContext().getNativeResponse()" result="viewScope.response" /></font></div><div class="gmail_default" style=""><font face="trebuchet ms, sans-serif"> <evaluate expression="T(net.shibboleth.utilities.java.support.codec.HTMLEncoder)" result="viewScope.encoder" /></font></div><div class="gmail_default" style=""><font face="trebuchet ms, sans-serif"> <evaluate expression="flowRequestContext.getActiveFlow().getApplicationContext().containsBean('shibboleth.CustomViewContext') ? flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.CustomViewContext') : null" result="viewScope.custom" /></font></div><div class="gmail_default" style=""><font face="trebuchet ms, sans-serif"> </on-render></font></div><div class="gmail_default" style=""><font face="trebuchet ms, sans-serif"><br></font></div><div class="gmail_default" style=""><font face="trebuchet ms, sans-serif"> <transition to="proceed" /></font></div><div class="gmail_default" style=""><font face="trebuchet ms, sans-serif"> </view-state></font></div><div class="gmail_default" style=""><font face="trebuchet ms, sans-serif"><br></font></div><div class="gmail_default" style=""><font face="trebuchet ms, sans-serif">This works so far. If the password has expired, </font><span style="font-family:"trebuchet ms",sans-serif">freeipa-password-expired view is displayed.</span></div><div class="gmail_default" style=""><span style="font-family:"trebuchet ms",sans-serif"><br></span></div><div class="gmail_default" style=""><span style="font-family:"trebuchet ms",sans-serif">Problem is when the user goes to the SP again in a short time and then gets redirected to IdP, because of the </span><span style="font-family:"trebuchet ms",sans-serif">shib_idp_session cookie, authentication does not take place and "</span><font face="trebuchet ms, sans-serif">net.shibboleth.idp.authn.context.AuthenticationContext" will be "null" and hence I get an exception like below. </font></div><div class="gmail_default" style=""><font face="trebuchet ms, sans-serif"><br></font></div><div class="gmail_default" style=""><font face="trebuchet ms, sans-serif"><div class="gmail_default">2016-07-22 17:08:24,474 - ERROR [net.shibboleth.idp.profile.interceptor:-2] - Uncaught runtime exception</div><div class="gmail_default">org.springframework.binding.expression.EvaluationException: An ELException occurred getting the value for expression 'ldapResponseContext.getAuthenticationResponse()' on context [class org.springframework.webflow.engine.impl.RequestControlContextImpl]</div><div class="gmail_default"> at org.springframework.binding.expression.spel.SpringELExpression.getValue(SpringELExpression.java:92)</div><div class="gmail_default">Caused by: org.springframework.expression.spel.SpelEvaluationException: EL1011E:(pos 20): Method call: Attempted to call method getAuthenticationResponse() on null context object</div><div class="gmail_default"> at org.springframework.expression.spel.ast.MethodReference.throwIfNotNullSafe(MethodReference.java:144)</div></font></div><div class="gmail_default" style=""><font face="trebuchet ms, sans-serif"><br></font></div><div class="gmail_default" style=""><font face="trebuchet ms, sans-serif">Thanks.</font></div><div class="gmail_default" style=""><font face="trebuchet ms, sans-serif">--Prashant</font></div><div class="gmail_default" style=""><br></div></div></div><div class="gmail_extra"><br><div class="gmail_quote">On 22 July 2016 at 21:33, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">> When I enabled the intercept flow with a non-proceed event, the user is<br>
> displayed a "access denied" view. This also sets the shib_idp_session cookie.<br>
<br>
</span>That is not an API, it's not public. If there's some problem, then maybe whatever you're trying to do can't be done or has to be done some other way, but working around that with the cookie is not allowed. You have not made it clear what you're trying to do or what you want to happen.<br>
<br>
If you're trying to retroactively prevent the memory of a login, that is not a supported feature. Once you're this far, that's already happened. You shouldn't be letting authentication succeed if you need it to, well, not succeed. That is not a valid use of the interceptors. All you can do here is prevent a specific request to an SP from completing.<br>
<span class=""><br>
> If the user were to visit the IdP page again, it does not show the login page<br>
> instead throws an error.<br>
<br>
</span>There is no "IdP page" to visit, nor do I know what "error" means.<br>
<span class=""><br>
> Hope I'm making sense.<br>
<br>
</span>Not really, and I don't know what you're actually trying to do here to begin with.<br>
<div class="HOEnZb"><div class="h5"><br>
-- Scott<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div>