<html><body><div dir="ltr">Our Security Operations is asking to add a java script to the IdP SSO login page that would detect and record presenting that page from outside our domain. This script depends on using variables like:<pre class="c-mrkdwn__pre" style="box-sizing:inherit;margin-top:4px;margin-bottom:4px;padding:8px;font-size:12px;font-variant-ligatures:none;line-height:1.50001;word-break:normal;background:rgba(var(--sk_foreground_min,29,28,29),0.04);border:1px solid var(--saf-0);border-radius:4px;overflow-y:hidden;color:rgb(29,28,29);font-family:Monaco,Menlo,Consolas,"Courier New",monospace!important"> var l = location.href;
var r = document.referrer;
</pre><div><br></div><div>I think that would require using the $custom velocity variable analogous to what’s documented for adding logging:<div><a href="https://shibboleth.atlassian.net/wiki/spaces/KB/pages/1424851284/Logging+Inside+IdP+Views">https://shibboleth.atlassian.net/wiki/spaces/KB/pages/1424851284/Logging+Inside+IdP+Views</a></div><div dir="ltr"><br></div><div dir="ltr">(I’m supposing any sophisticated attempt to clone could simply remove any reference to such a script, but perhaps it’s worthwhile catching naive attempts - anyway, that’s outside the scope of my query here.)</div><div dir="ltr"><br></div><div dir="ltr">Has anyone implemented something similar (or dissimilar deployment to the same end of detecting spoofed login page)? </div><div dir="ltr">Thanks for any hints, warnings, even dope-slaps if warranted.</div><div dir="ltr"><br></div><div dir="ltr">David St Pierre Bantz</div></div><div dir="ltr">University of Alaska IAM</div></div></body></html>