<div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr">For the few SPs that need both context checks you might consider a "RelyingPartyByTag" override to activate the SAML2.SSO.MDDriven profile.<div><br></div><div>in relying-party define:</div><div><br></div><div><div> <bean id="rpmdd" parent="RelyingPartyByTag"></div><div> <constructor-arg name="candidates"></div><div> <list></div><div> <bean parent="TagCandidate" c:name="custom:policy:rp"</div><div> p:values="mdd"/></div><div> </list></div><div> </constructor-arg></div><div> <property name="profileConfigurations"></div><div> <list></div><div> <bean id="rpmdd-b1" parent="SAML2.SSO.MDDriven" /></div><div> </list></div><div> </property></div><div> </bean></div></div><div><br></div><div>In the Metadata for the SPs add the EntityAttributes:</div><div><br></div><div><div> <mdattr:EntityAttributes xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute"></div><div><br></div><div> <saml:Attribute xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Name="custom:policy:rp "</div><div> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"></div><div><br></div><div> <saml:AttributeValue>mdd</saml:AttributeValue></div><div><br></div><div> </saml:Attribute><br></div><div><br></div><div> <saml:Attribute xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" Name="<a href="http://shibboleth.net/ns/profiles/postAuthenticationFlows">http://shibboleth.net/ns/profiles/postAuthenticationFlows</a>"</div><div> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"></div><div><br></div><div> <saml:AttributeValue>context-check</saml:AttributeValue></div><div> <saml:AttributeValue>expiring-password</saml:AttributeValue></div><div><br></div><div> </saml:Attribute></div><div><br></div><div> </mdattr:EntityAttributes></div></div><div><br></div><div><br></div><div>Then add EntityAttributes to configure the specifics for the SPs.</div><div><br></div><div>Just a thought....</div><div><br></div><div>-John S<br></div><div><br></div></div></div></div></div><br><div class="gmail_quote"><div dir="ltr">On Mon, Nov 26, 2018 at 3:35 PM Ian Bobbitt <<a href="mailto:ibobbitt@globalnoc.iu.edu">ibobbitt@globalnoc.iu.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">What's the best way to apply both metadata driven and IdP configured post-authentication flows?<br>
<br>
In my case, I want to apply the expiring-password intercept to all SPs, and a few SPs need custom context check intercepts.<br>
<br>
Adding an Attribute with Name <a href="http://shibboleth.net/ns/profiles/postAuthenticationFlows" rel="noreferrer" target="_blank">http://shibboleth.net/ns/profiles/postAuthenticationFlows</a> to the metadata for a SP seems<br>
to replace all p:authenticationFlows configured on SAML2.SSO.MDDriven in the relying party config rather than merging<br>
like I was hoping.<br>
<br>
I control all of the metadata here, so I don't need to sanitize external input by indirect filtering on tags, unless<br>
that ends up being easier.<br>
<br>
-- Ian<br>
<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a></blockquote></div><br clear="all"><div><br></div>-- <br><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><span style="font-size:14px;line-height:24px;color:rgb(68,68,68);font-family:'Open Sans',Helvetica,Arial,sans-serif">John Schrader</span><br></div><div><font color="#444444" face="Open Sans, Helvetica, Arial, sans-serif"><span style="font-size:14px;line-height:24px">Identity and Access Management</span></font></div><div><font color="#444444" face="Open Sans, Helvetica, Arial, sans-serif"><span style="font-size:14px;line-height:24px">Office of Information Technologies</span></font></div><div><font color="#444444" face="Open Sans, Helvetica, Arial, sans-serif"><span style="font-size:14px;line-height:24px">University of Notre Dame</span></font></div><div><br></div><div dir="ltr"><span style="color:rgb(68,68,68);font-family:'Open Sans',Helvetica,Arial,sans-serif;font-size:14px;font-style:italic;line-height:24px">EVERYTHING SHOULD BE MADE AS SIMPLE AS POSSIBLE, BUT NOT ANY SIMPLER</span><div><span style="color:rgb(68,68,68);font-family:'Open Sans',Helvetica,Arial,sans-serif;font-size:14px;font-style:italic;line-height:24px">—ALBERT EINSTEIN</span><br></div></div></div></div></div></div></div></div>