<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
Hi Scott,
<div class=""><br class="">
</div>
<div class="">Got it, I missed one of the mistyped characters. Thank you for all of the help</div>
<div class=""><br class="">
</div>
<div class="">For anyone that reads this in the future here’s what I did. </div>
<div class=""><br class="">
</div>
<div class="">Created custom view <font color="#ff40ff" class="">fduchangedpassword</font>.vm</div>
<div class=""><br class="">
</div>
<div class="">I edited <b class="">conf/authn/password-authn-config.xml </b><span class="">creating an error code for the error condition(s) I wanted to catch</span></div>
<div class=""><br class="">
</div>
<div class=""><span class="Apple-tab-span" style="white-space:pre"></span>I wanted AD user must change password on next login and AD password expired</div>
<div class=""><br class="">
<div class="">
<div class=""> <entry key="<font color="#0433ff" class="">FDUExpiredPassword</font>"></div>
<div class=""> <list></div>
<div class=""> <value>ERROR_PASSWORD_EXPIRED</value></div>
<div class=""> <value>ERROR_PASSWORD_MUST_CHANGE</value></div>
<div class=""> <value>PASSWORD_EXPIRED</value></div>
<div class=""> <value>PASSWORD_MUST_CHANGE</value></div>
<div class=""> <value>532</value></div>
<div class=""> <value>773</value></div>
<div class=""> </list></div>
<div class=""> </entry></div>
</div>
<div><br class="">
</div>
<div>I edited <b class="">flows/authn/conditions/conditions-flow.xml </b><span class="">to break out of ValidateUsernamePassword and handle my custom condition</span></div>
<div><span class=""><br class="">
</span></div>
<div class="">
<div class=""> <action-state id="ValidateUsernamePassword"></div>
<div class=""><span class="Apple-tab-span" style="white-space: pre;"></span> <transition on=“<font color="#0433ff" class="">FDUExpiredPassword"</font> to="<font color="#ff2600" class="">FDUExpiredPasswordError</font>" /></div>
<div class=""> <transition on="AccountWarning" to="CallExpiringPassword" /></div>
<div class=""> <transition on="ExpiringPassword" to="CallExpiringPassword" /></div>
<div class=""> <transition on="ExpiredPassword" to="CallExpiredPassword" /></div>
<div class=""> <transition on="AccountLocked" to="CallAccountLocked" /></div>
<div class=""> <transition to="DisplayUsernamePasswordPage" /></div>
<div class=""> </action-state></div>
<div class=""><br class="">
</div>
<div class="">
<div class=""><span class="">I edited</span><b class=""> conf/authn/authn-events-flow.xml
</b><span class="">as outlined in <span class=""><a href="https://wiki.shibboleth.net/confluence/display/IDP30/AuthenticationConfiguration#AuthenticationConfiguration-CustomEvents" class="">https://wiki.shibboleth.net/confluence/display/IDP30/AuthenticationConfiguration#AuthenticationConfiguration-CustomEvents</a></span></span></div>
<span class=""><br class="">
</span>
<div class="">
<div class=""> <end-state id="<font color="#ff2600" class="">FDUExpiredPasswordError</font>" /></div>
<div class=""><br class="">
</div>
<div class=""> <global-transitions></div>
<div class=""> <transition on="<font color="#ff2600" class="">FDUExpiredPasswordError</font>" to=“<font color="#ff2600" class="">FDUExpiredPasswordError</font>" /></div>
<div class=""> <transition on="#{!'proceed'.equals(<a href="http://currentEvent.id" class="">currentEvent.id</a>)}" to="InvalidEvent" /></div>
<div class=""> </global-transitions></div>
<div class=""><br class="">
</div>
<div class="">
<div class=""><span class="">I edited</span><b class=""> conf/errors.xml </b><span class="">to tell theIDP which view to display and to handle locally as outlined in <span class=""><a href="https://wiki.shibboleth.net/confluence/display/IDP30/ErrorHandlingConfiguration#ErrorHandlingConfiguration-EventCategorization" class="">https://wiki.shibboleth.net/confluence/display/IDP30/ErrorHandlingConfiguration#ErrorHandlingConfiguration-EventCategorization</a></span></span></div>
<span class=""><br class="">
</span>
<div class="">
<div class=""> <util:map id="shibboleth.EventViewMap"></div>
<div class=""> <entry key=“<font color="#ff2600" class="">FDUExpiredPasswordError</font>" value="<font color="#ff40ff" class="">fduchangedpassword</font>" /></div>
<div class=""> </util:map></div>
<div class=""><br class="">
</div>
<div class=""> <util:map id="shibboleth.LocalEventMap"></div>
<div class=""> <entry key="<font color="#ff2600" class="">FDUExpiredPasswordError</font>'" value="true" /></div>
<div class=""> ...</div>
<div class=""> </util:map></div>
<div class=""><br class="">
</div>
<div class="">-Chris</div>
</div>
</div>
</div>
</div>
</div>
<div><br class="">
<blockquote type="cite" class="">
<div class="">On Jan 30, 2019, at 9:40 PM, Mr. Christopher Bland <<a href="mailto:chris@fdu.edu" class="">chris@fdu.edu</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">
Hi Scott,
<div class=""><br class="">
</div>
<div class="">Even closer now. Not sure how you saw the extra characters but definitely part of the problem. I fixed the mistyped characters and now I have fixed my IDP so well it goes back to the SP with an error message instead of displaying my error page.</div>
<div class=""><br class="">
</div>
<div class="">
<div class="">2019-01-30 21:32:01,828 - 132.238.11.244 - WARN [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event occurred while processing the request: FDUExpiredPasswordError</div>
<div class="">2019-01-30 21:32:01,998 - 132.238.11.244 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:179] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.messaging.handler.impl.BasicMessageHandlerChain'
on OUTBOUND message context</div>
<div class="">2019-01-30 21:32:01,999 - 132.238.11.244 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:195] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.ResponseImpl'</div>
<div class="">2019-01-30 21:32:02,022 - 132.238.11.244 - DEBUG [net.shibboleth.idp.saml.profile.impl.SpringAwareMessageEncoderFactory:100] - Looking up message encoder based on binding URI: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST</div>
<div class=""><br class="">
</div>
<div class="">I thought maybe I mixed up the true/false for local events in <b class="">conf/errors.xml</b></div>
<div class=""><b class=""><br class="">
</b></div>
<div class="">
<div class=""> <util:map id="shibboleth.LocalEventMap"></div>
<div class=""> <entry key="<font color="#ff2600" class="">FDUExpiredPasswordError</font>'" value="true" /></div>
<div class=""> ...</div>
<div class=""> </util:map></div>
<div class=""><br class="">
</div>
</div>
<div class="">I switched false to true and still got the same results</div>
<div class=""><br class="">
</div>
<div class="">-Chris</div>
<div class=""><br class="">
<blockquote type="cite" class="">
<div class="">On Jan 30, 2019, at 8:48 PM, Cantor, Scott <<a href="mailto:cantor.2@osu.edu" class="">cantor.2@osu.edu</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div class="">On 1/30/19, 8:39 PM, "users on behalf of Mr. Christopher Bland" <<a href="mailto:users-bounces@shibboleth.net" class="">users-bounces@shibboleth.net</a> on behalf of
<a href="mailto:chris@fdu.edu" class="">chris@fdu.edu</a>> wrote:<br class="">
<br class="">
<blockquote type="cite" class="">This doesn’t make sense because the state id it’s looking for is in the list of known state id’s<br class="">
</blockquote>
<br class="">
Yes. That means "facts not in evidence", so we're talking hidden characters, a mistyped character somewhere, etc. Eyeballing, I think you have an extra single quote inside the double quote in a bunch of those event expressions.<br class="">
<br class="">
-- Scott<br class="">
<br class="">
<br class="">
-- <br class="">
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" class="">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br class="">
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" class="">
users-unsubscribe@shibboleth.net</a></div>
</div>
</blockquote>
</div>
<br class="">
</div>
</div>
-- <br class="">
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" class="">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br class="">
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" class="">
users-unsubscribe@shibboleth.net</a></div>
</blockquote>
</div>
<br class="">
</div>
</body>
</html>