<div dir="ltr"><div class="gmail_default" style="font-family:"trebuchet ms",sans-serif">Scott, </div><div class="gmail_default" style="font-family:"trebuchet ms",sans-serif"><br></div><div class="gmail_default" style="font-family:"trebuchet ms",sans-serif">Thanks for the pointers. I'm able to modify the expiring-password intercept flow to my needs. Something like below works;</div><div class="gmail_default" style="font-family:"trebuchet ms",sans-serif"><br></div><div class="gmail_default" style="font-family:"trebuchet ms",sans-serif"><div class="gmail_default"> <on-start></div><div class="gmail_default"> <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext))" result="flowScope.authenticationContext" /></div><div class="gmail_default"> <evaluate expression="authenticationContext.getSubcontext(T(net.shibboleth.idp.authn.context.LDAPResponseContext))" result="flowScope.ldapResponseContext" /></div><div class="gmail_default"> <evaluate expression="ldapResponseContext.getAuthenticationResponse().getLdapEntry().getAttribute('krbPasswordExpiration').getStringValue()" result="flowScope.expirationDateString" /></div><div class="gmail_default"> <evaluate expression="T(org.slf4j.LoggerFactory).getLogger('net.shibboleth.idp.profile').debug(expirationDateString)" /></div><div class="gmail_default"> <evaluate expression="T(org.joda.time.DateTime).parse(expirationDateString, T(org.joda.time.format.DateTimeFormat).forPattern("yyyyMMddHHmmss'Z'"))" result="flowScope.expirationDate" /></div><div class="gmail_default"> <evaluate expression="T(org.joda.time.DateTime).now()" result="flowScope.currentDate" /></div><div class="gmail_default"> <evaluate expression="T(org.joda.time.Minutes).minutesBetween(currentDate.toLocalDateTime(), expirationDate.toLocalDateTime()).getMinutes()" result="flowScope.dateDiff" /></div><div class="gmail_default"> <evaluate expression="T(org.slf4j.LoggerFactory).getLogger('net.shibboleth.idp.profile').debug('Time in minutes to password expiry : ' + dateDiff)" /></div><div class="gmail_default"> </on-start></div><div class="gmail_default"><br></div><div class="gmail_default">What is the recommended way to deny user login before/after displaying the respective view ? </div><div class="gmail_default"><br></div><div class="gmail_default"><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On 13 July 2016 at 18:20, Cantor, Scott <span dir="ltr"><<a href="mailto:cantor.2@osu.edu" target="_blank">cantor.2@osu.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span>On 7/13/16, 8:20 AM, "users on behalf of Prashant Bapat" <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a> on behalf of <a href="mailto:prashant@apigee.com" target="_blank">prashant@apigee.com</a>> wrote:<br>
<br>
> I tried to look at the Javadoc but still not able to figure this out. I'm not familiar<br>
> with Java.<br>
<br>
</span>Well, that's a problem, obviously.<br>
<span><br>
> How do I get the passwordExpiration attribute from here ?<br>
<br>
</span>By accessing the attribute set from the AttributeContext's methods. You need to know at least basic Java. I'm sorry, but that's just how it is.<br>
<div><div><br>
-- Scott<br>
<br>
<br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</div></div></blockquote></div><br></div></div>