<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri",sans-serif;}
span.EmailStyle21
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal>We considered the in-line approach when we last re-did our account recovery flows, but ultimately decided against it. The number of external dependencies that are involved here when a password changes was great enough that the in-line approach would’ve had a negative impact on our HA capabilities. Instead what we did was a hybrid approach where the IdP would authenticate the individual (or attempt to authenticate the individual via various means (Password, SMS/Email OTP, KBA, etc) and then cause the IdP to send a SAML response (minus any authncontextclassrefs) to our password change app rather than the app the user was trying to go. Works decently, though that does leave the user with a SSO session that does not have any AuthnContextClassRefs on it. For SPs that don’t care about that field, the user continues normally and happily. For SPs that do care about class-ref, the IdP will step-up as necessary (assuming the user now knows their password). The hard edge in this scenario that does bite us infrequently, but enough to be visible in support metrics, is the SP that cares about AuthnContextClassRef, but doesn’t put what it wants in the AuthnRequest. <o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Dave<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><div><p class=MsoNormal>--<o:p></o:p></p><p class=MsoNormal>David Langenberg<o:p></o:p></p><p class=MsoNormal>Asst Director, Identity Management<o:p></o:p></p><p class=MsoNormal>The University of Chicago<o:p></o:p></p></div><p class=MsoNormal><o:p> </o:p></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b>From:</b> users <users-bounces@shibboleth.net> <b>On Behalf Of </b>Koch, Ken<br><b>Sent:</b> Tuesday, November 6, 2018 11:34 AM<br><b>To:</b> users@shibboleth.net<br><b>Subject:</b> Password Change Solutions<o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Verdana",sans-serif;color:#1F497D'>Greetings all. I’m working through conceptual changes to our login flow that removes as many external dependencies as possible, consolidating everything on easily portable IDPs. One function I’m stuck on is forcing a password change on an expired password. Has anyone done this with IDP flows and Spring/Velocity? I know how to trap the expired password and proceed with a custom flow but I’m hoping to implement the password change screen right there, rather than link out to an external page. Is anyone doing this?<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:8.0pt;font-family:"Verdana",sans-serif;color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:8.0pt;font-family:"Verdana",sans-serif;color:#1F497D'>____________________________________________________________<o:p></o:p></span></p><p class=MsoNormal><b><span style='font-size:8.0pt;font-family:"Verdana",sans-serif;color:#1F497D'>Ken Koch</span></b><span style='font-size:8.0pt;font-family:"Verdana",sans-serif;color:#1F497D'> | Infrastructure Architect, Enterprise Engineering<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:8.0pt;font-family:"Verdana",sans-serif;color:#1F497D'>Washington University in St. Louis<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:8.0pt;font-family:"Verdana",sans-serif;color:#1F497D'>4480 Clayton Ave., Campus Box 8218 | Clayton, MO 63110<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:8.0pt;font-family:"Verdana",sans-serif;color:#1F497D'>w 314-935-8315 | c 314-223-7256 | <a href="mailto:ken@wustl.edu">ken@wustl.edu</a><o:p></o:p></span></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='font-size:10.0pt;font-family:"Arial",sans-serif'><o:p> </o:p></span></p><p class=MsoNormal><o:p> </o:p></p><div class=MsoNormal align=center style='text-align:center'><hr size=2 width="100%" align=center></div><p class=MsoNormal><span style='font-size:7.5pt;font-family:"Arial",sans-serif;color:gray'>The materials in this message are private and may contain Protected Healthcare Information or other information of a sensitive nature. If you are not the intended recipient, be advised that any unauthorized use, disclosure, copying or the taking of any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error, please immediately notify the sender via telephone or return mail.</span><o:p></o:p></p></div></body></html>