{"type":"doc","content":[{"type":"paragraph","content":[{"text":"Current File(s):","type":"text","marks":[{"type":"strong"}]},{"text":" ","type":"text"},{"text":"conf/authn/password-authn-config.xml, views/login.vm, conf/authn/authn.properties","type":"text","marks":[{"type":"em"}]},{"type":"hardBreak"},{"text":"Format:","type":"text","marks":[{"type":"strong"}]},{"text":" Native Spring","type":"text"}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"maxLevel":{"value":"2"}},"macroMetadata":{"macroId":{"value":"244af1c2-1bbc-45da-98e1-e054dd7aaee9"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"9d8725a6-8cb3-4f39-8b06-14916a70d723"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"Overview","type":"text"}]},{"type":"paragraph","content":[{"text":"The authn/Password login flow supports an extensible set of back-ends for password-based authentication, normally collected using a web form, and is the flow used at least in part by most deployments.","type":"text"}]},{"type":"paragraph","content":[{"text":"It is compatible with non-browser clients by virtue of supporting HTTP Basic authentication if credentials are provided without prompting, and knows not to present a form when a non-browser profile like ","type":"text"},{"text":"ECP","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/CONCEPT/pages/928645114"}}]},{"text":" is used.","type":"text"}]},{"type":"paragraph","content":[{"text":"The IdP includes a dedicated plugin API for developing custom \"back-ends\", the ","type":"text"},{"text":"CredentialValidator","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.authn.CredentialValidator"}}]},{"text":" interface and some associated base classes for assisting in developing new ones. The flow also supports chaining of ","type":"text"},{"text":"CredentialValidator","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.authn.CredentialValidator"}}]},{"text":" plugins in arbitrary sequences instead of requiring the use of JAAS login modules for that feature.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Enabling Module","type":"text"}]},{"type":"paragraph","content":[{"text":"Configuring and using this feature requires that you first enable the \"idp.authn.Password\" ","type":"text"},{"text":"module","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510765"}}]},{"text":" if it isn't already enabled. Systems upgraded from older releases generally come pre-enabled due to the prior state of the configuration tree.","type":"text"}]},{"type":"codeBlock","content":[{"text":"(Windows)\nC:\\opt\\shibboleth-idp> bin\\module.bat -t idp.authn.Password || bin\\module.bat -e idp.authn.Password\n \n(Other)\n$ bin/module.sh -t idp.authn.Password || bin/module.sh -e idp.authn.Password","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"General Configuration","type":"text"}]},{"type":"paragraph","content":[{"text":"Most features of this flow are configured with ","type":"text"},{"text":"authn/authn.properties,","type":"text","marks":[{"type":"em"}]},{"text":" with some advanced features relying on ","type":"text"},{"text":"authn/password-authn-config.xml","type":"text","marks":[{"type":"em"}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"For detailed information on configuring the supplied back-ends, see:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"LDAPAuthnConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505688"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"JAASAuthnConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505735"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"KerberosAuthnConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505778"}}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"HTPasswdAuthnConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505813"}}]}]}]}]},{"type":"paragraph","content":[{"text":"Aside from the more specific back-end configurations, there are beans and properties defined for some general configuration independent of the back-end chosen. They are all listed in the reference section below.","type":"text"}]},{"type":"paragraph","content":[{"text":"The most important bean is ","type":"text"},{"text":"shibboleth.authn.Password.Validators","type":"text","marks":[{"type":"strong"}]},{"text":", a List of ","type":"text"},{"text":"CredentialValidator","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.authn.CredentialValidator"}}]},{"text":" plugins that should be used to validate the subject's username and password.","type":"text"}]},{"type":"paragraph","content":[{"text":"A property named ","type":"text"},{"text":"idp.authn.Password.requireAll","type":"text","marks":[{"type":"strong"}]},{"text":" controls whether the credentials must be validated successfully by all applicable plugins in the list, or just one.","type":"text"}]},{"type":"paragraph","content":[{"text":"Combining plugins tends to be more complex but the default, requiring only a single valid result, is fairly simple to deal with. One obvious issue is that you should make sure to set the property named ","type":"text"},{"text":"idp.authn.Password.removeAfterValidation","type":"text","marks":[{"type":"strong"}]},{"text":" to false if you apply the \"require all\" mode to prevent the username/password information from being pulled mid-request.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Basic Features","type":"text"}]},{"type":"expand","attrs":{"title":"User Interface"},"content":[{"type":"paragraph","content":[{"text":"The first user interface layer of the flow is actually HTTP Basic authentication; if a header with credentials is supplied, the credentials are tested immediately with no prompting. If that step fails, or no credentials are supplied, then a view is rendered unless the request is for passive authentication or part of a non-browser profile.","type":"text"}]},{"type":"paragraph","content":[{"text":"Views","type":"text","marks":[{"type":"link","attrs":{"href":"http://docs.spring.io/spring-webflow/docs/current/reference/html/views.html"}}]},{"text":" are handled by Spring Web Flow, so support various technologies, but Velocity and JSP are supported by default and the examples are all based on Velocity.","type":"text"}]},{"type":"panel","attrs":{"panelType":"error"},"content":[{"type":"paragraph","content":[{"text":"Be aware that the default view templates and configuration of classified messages (see later section on Errors and Warnings) results in a system that will report context-sensitive errors to the user, such as whether the password was invalid or the username was mis-entered. This is appropriate for most organizations to reduce help desk calls caused by simple user error, but some organizations keep usernames a secret and may wish to adjust the configuration to collapse all error reporting and avoid leaking information about whether usernames are valid or not.","type":"text"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Example Velocity User Interface","type":"text"}]},{"type":"paragraph","content":[{"text":"The example Velocity templates ","type":"text"},{"text":"views/login.vm","type":"text","marks":[{"type":"em"}]},{"text":" and ","type":"text"},{"text":"views/login-error.vm ","type":"text","marks":[{"type":"em"}]},{"text":"illustrate generally how to populate the form, and how to detect and respond to error conditions. Internationalization is performed through the use of Spring message properties (which can be overridden via the top-level ","type":"text"},{"text":"messages","type":"text","marks":[{"type":"strong"}]},{"text":" folder). Information on Spring internationalization is near the end of ","type":"text"},{"text":"this section","type":"text","marks":[{"type":"link","attrs":{"href":"http://docs.spring.io/spring/docs/4.2.1.RELEASE/spring-framework-reference/html/beans.html#context-functionality-messagesource"}}]},{"text":" of the Spring documentation.","type":"text"}]},{"type":"paragraph","content":[{"text":"When rendering Velocity views, ","type":"text"},{"text":"several variables","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199510821"}}]},{"text":" are available to aid per-relying party customization.","type":"text"}]},{"type":"paragraph","content":[{"text":"Spring form generation macros such as ","type":"text"},{"text":"#springMessage and #springMessageText","type":"text","marks":[{"type":"em"}]},{"text":" are available to Velocity templates.","type":"text"}]},{"type":"paragraph","content":[{"text":"You can freely comment out or remove the \"Do Not Cache\" support of course, or use Javascript to automate it for certain address ranges.","type":"text"}]},{"type":"heading","attrs":{"level":4},"content":[{"text":"Error Handling ","type":"text"},{"text":"5.1","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"This material replaces the historical behavior, which was to supply a login-error.vm template that was rendered to directly produce the error displayed to the user. The new approach is more concise, faster, and friendlier to other template languages, but deployers remain free to do whatever they prefer.","type":"text"}]}]},{"type":"paragraph","content":[{"text":"By default, a Java class is supplied and installed that implements a standard form of “analysis” of the state of the request to produce a plausible error message to display to the user. This is suitable for routine cases, and is called by the default login view template via the standard variable “errorMessageFunction”.","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"idp.authn.Password.errorMessageFunction","type":"text","marks":[{"type":"strong"}]},{"text":" property can be set to a custom bean definition of type Function<","type":"text"},{"text":"ProfileRequestContext","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.profile.context.ProfileRequestContext"}}]},{"text":",String> to do their own error handling, including via scripting, etc.","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"Older/Advanced Error Handling Example","type":"text"}]},{"type":"paragraph","content":[{"text":"The error message classification feature allows error messages to be mapped into grouped \"classes\" of errors that can be used in the view to report the results of a failed login. The main value of this feature is in supporting chains of multiple validators because the system will accumulate all of the classified errors that occur so that a precedence of error types can be applied to decide what to report to the user. A working example of this dating back to the older view-centric model:","type":"text"}]},{"type":"heading","attrs":{"level":5},"content":[{"text":"views/login-error.vm","type":"text","marks":[{"type":"strong"}]}]},{"type":"codeBlock","attrs":{"language":"plaintext"},"content":[{"text":"## Velocity Template for login error message production, included by login.vm\n##\n## authenticationErrorContext - context containing error data, if available\n##\n#if ($authenticationErrorContext && $authenticationErrorContext.getClassifiedErrors().size() > 0 && $authenticationErrorContext.getClassifiedErrors().iterator().next() != \"ReselectFlow\")\n ## This handles errors that are classified by the message maps in the config.\n #if ($authenticationErrorContext.getClassifiedErrors().contains(\"InvalidPassword\"))\n #set ($eventId = \"InvalidPassword\")\n #elseif ($authenticationErrorContext.getClassifiedErrors().contains(\"AccountLocked\"))\n #set ($eventId = \"AccountLocked\")\n #elseif ($authenticationErrorContext.getClassifiedErrors().contains(\"AccountDisabled\"))\n #set ($eventId = \"AccountDisabled\")\n #elseif ($authenticationErrorContext.getClassifiedErrors().contains(\"ExpiredPassword\"))\n #set ($eventId = \"ExpiredPassword\")\n #elseif ($authenticationErrorContext.getClassifiedErrors().contains(\"UnknownUsername\"))\n #set ($eventId = \"UnknownUsername\")\n #end\n#elseif ($authenticationErrorContext && $authenticationErrorContext.getExceptions().size() > 0)\n ## This handles login exceptions that are left unclassified.\n #set ($loginException = $authenticationErrorContext.getExceptions().get(0))\n #if ($loginException.getMessage())\n #set ($message = \"Login Failure: $loginException.getMessage()\")\n #else\n \t#set ($message = \"Unidentified error\")\n #end\n#end\n\n#if ($eventId || $message)\n\t

\n\t#if ($eventId == \"AccountLocked\")\n\t\t## your code here\n\t#elseif ($eventId == \"AccountDisabled\")\n\t\t## your code here\n\t#elseif ($eventId == \"ExpiredPassword\")\n\t\t## your code here\n\t#elseif ($eventId == \"InvalidPassword\")\n\t\t## your code here\n\t#elseif ($eventId == \"UnknownUsername\")\n\t\t## your code here\n\t#elseif ($message)\n\t\t## your code here\n\t#end\n\t

\n#end","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"JSP User Interface","type":"text"}]},{"type":"paragraph","content":[{"text":"The use of JSP is not advised, but is supported. To do so, ","type":"text"},{"text":"views/login.vm","type":"text","marks":[{"type":"em"}]},{"text":" must be removed or renamed and the IdP restarted, or it will take precedence. Views in JSP should be created in ","type":"text"},{"text":"edit-webapp/WEB-INF/jsp","type":"text","marks":[{"type":"strong"}]},{"text":" (and the warfile should be recreated with ","type":"text"},{"text":"bin/build.sh","type":"text","marks":[{"type":"em"}]},{"text":" or ","type":"text"},{"text":"bin/build.bat","type":"text","marks":[{"type":"em"}]},{"text":" and the container restarted). The old ","type":"text"},{"text":"V2 Taglibs","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/SHIB2/pages/2577072469"}}]},{"text":" are supported for JSP for now, but we have plans to deprecate them in the future.","type":"text"}]}]},{"type":"expand","attrs":{"title":"Configuring Validators"},"content":[{"type":"paragraph","content":[{"text":"There are parent beans defined for each back-end plugin supported to allow easy incorporation of the default configured behavior into the chain of validators. There are \"global\" options for each back-end that will apply to any validator of the given type unless overridden.","type":"text"}]},{"type":"paragraph","content":[{"text":"For example, this syntax defines a single LDAP validator that uses settings defined in a manner consistent with older versions of the software. The parent bean is used \"as is\" with no changes.","type":"text"}]},{"type":"codeBlock","content":[{"text":"\n \n","type":"text"}]},{"type":"paragraph","content":[{"text":"This syntax in contrast uses the parent bean as a template:","type":"text"}]},{"type":"codeBlock","content":[{"text":"\n \n","type":"text"}]},{"type":"paragraph","content":[{"text":"In this case, the LDAP authenticator object used is explicitly set to the ","type":"text"},{"text":"bindSearchAuthenticator","type":"text","marks":[{"type":"strong"}]},{"text":" bean instead of the value set by the \"idp.authn.LDAP.authenticator\" property.","type":"text"}]},{"type":"paragraph","content":[{"text":"This is a simple example but the point is that once you switch from a ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" to a new, but inherited, ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":", you can default or override each property of the validator as you choose. The global/default settings in the individual Spring bean files only matter to the extent that you want to use them.","type":"text"}]}]},{"type":"expand","attrs":{"title":"Username Normalization and Matching"},"content":[{"type":"paragraph","content":[{"text":"There is support for case folding, trimming, and regular expression transformation of the username entered by a subject. The same features can be applied either globally or individually to each validator so that the normalized value may be different in each case, as required.","type":"text"}]},{"type":"paragraph","content":[{"text":"The globally defined properties are used if not overridden, but options exist on each supported ","type":"text"},{"text":"CredentialValidator","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.authn.CredentialValidator"}}]},{"text":" class to override a global setting with a more specific setting.","type":"text"}]},{"type":"paragraph","content":[{"text":"Note that the result of a successful authentication via a particular validator will typically produce a Java ","type":"text"},{"text":"Subject","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/javax.security.auth.Subject?module=java.sql"}}]},{"text":" containing a ","type":"text"},{"text":"UsernamePrincipal","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.authn.principal.UsernamePrincipal"}}]},{"text":" containing the ","type":"text"},{"text":"normalized","type":"text","marks":[{"type":"em"}]},{"text":" value specific to that validator, so it's possible when chaining and using the \"RequireAll\" feature to produce compound results containing multiple, distinct ","type":"text"},{"text":"UsernamePrincipal","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.authn.principal.UsernamePrincipal"}}]},{"text":" objects that will not work with the default/simple ","type":"text"},{"text":"SimplePostLoginC14NConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199506117"}}]},{"text":" used in many cases. Something more may be needed to tell the system which of the potentially multiple \"usernames\" should be the official one used in the session.","type":"text"}]},{"type":"paragraph","content":[{"text":"Similarly, the property ","type":"text"},{"text":"idp.authn.Password.matchExpression","type":"text","marks":[{"type":"strong"}]},{"text":" is applied globally, if set, but each ","type":"text"},{"text":"CredentialValidator","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.authn.CredentialValidator"}}]},{"text":" can be individually configured with their own ","type":"text"},{"text":"matchExpression","type":"text","marks":[{"type":"code"}]},{"text":" setting. If a validator detects that a candidate transformed/normalized username doesn't match the expression, the validator will silently be ignored. This is not considered a success or failure. Note that Spring will automatically convert a string into a regular expression pattern, so adding a localized match rule is as simple as:","type":"text"}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n \n \n","type":"text"}]}]},{"type":"expand","attrs":{"title":"Errors and Warnings"},"content":[{"type":"paragraph","content":[{"text":"A special feature of this flow is the ability to inject your own behavior in response to particular error or warning conditions that occur. These conditions are set via the ","type":"text"},{"text":"shibboleth.authn.Password.ClassifiedMessageMap","type":"text","marks":[{"type":"strong"}]},{"text":" bean in ","type":"text"},{"text":"authn/password-authn-config.xml","type":"text","marks":[{"type":"em"}]},{"text":". If you map a particular string label to one or more exception/error messages in the map, that string label becomes a flow \"event\" that you can program the flow to respond to.","type":"text"}]},{"type":"paragraph","content":[{"text":"If your goal is to terminate processing at this point, then you should take a look at the discussion in ","type":"text"},{"text":"AuthenticationConfiguration","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199505085"}}]},{"text":" under \"Custom Events\", which describes how to configure the system to treat your custom events as allowable \"end\" states for the request and handle them as errors.","type":"text"}]},{"type":"paragraph","content":[{"text":"If your goal is rather to interrupt but then resume the login flow, then this is somewhat accomodated with a predefined set of flow defintions designed to be user-editable in ","type":"text"},{"text":"flows/authn/conditions/","type":"text","marks":[{"type":"strong"}]},{"text":", but this is a fairly exotic approach and is not advisable in most cases.","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"conditions-flows.xml","type":"text","marks":[{"type":"em"}]},{"text":" file controls what events are detected and handled, and what to do. The example included responds to a number of events by calling predefined subflows that are themselves just empty examples that return immediately, and then control passes back to the view state that renders the login form.","type":"text"}]},{"type":"paragraph","content":[{"text":"An obvious use for this feature is responding to an imminently expiring password with some kind of warning view; another is detection of a locked account, and the use of a dedicated view to help the user with that condition.","type":"text"}]},{"type":"paragraph","content":[{"text":"In the simplest case, maybe you just want to display a page, in which case you can insert your own ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" that displays a template of your own creation. Views generally have to contain a form whose action is set to \"$flowExecutionUrl\" and that contain a button to submit the form with the value \"_eventId_proceed\". Your view then transitions on \"proceed\" to the corresponding ","type":"text"},{"text":"","type":"text","marks":[{"type":"code"}]},{"text":" and ends up back on the login form.","type":"text"}]},{"type":"paragraph","content":[{"text":"In more complex cases, you may need to actually redirect the user out to other functionality implemented outside the IdP, which is something the Spring Web Flow documentation refers to as an external redirect, and it's possible to resume the flow in that scenario as well. If you don't, the user's session is suspeneded and will consume resources until it times out, and that doesn't work well at scale, so you have to be careful with that approach.","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Advanced Features","type":"text"}]},{"type":"expand","attrs":{"title":"Account Lockout"},"content":[{"type":"paragraph","content":[{"text":"A pluggable implementation of account lockout can be enabled by defining a bean called ","type":"text"},{"text":"shibboleth.authn.Password.AccountLockoutManager","type":"text","marks":[{"type":"strong"}]},{"text":" that implements the ","type":"text"},{"text":"AccountLockoutManager","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.authn.AccountLockoutManager"}}]},{"text":" interface. A default implementation of this interface is available using a parent bean named ","type":"text"},{"text":"shibboleth.StorageBackedAccountLockoutManager","type":"text","marks":[{"type":"strong"}]},{"text":" (commented out by default in ","type":"text"},{"text":"conf/authn/password-authn-config.xml","type":"text","marks":[{"type":"em"}]},{"text":").","type":"text"}]},{"type":"paragraph","content":[{"text":"The default implementation has the following behavior:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Tracks lockout state via an injected ","type":"text"},{"text":"StorageService","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.storage.StorageService"}}]},{"text":", by default the in-memory variant preconfigured with the IdP. This results in per-node lockout tracking, usually sufficient considering the overhead of other options.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Provides a simple algorithm that tracks invalid attempts that occur within a specified interval, and once a limit is reached, blocks subsequent attempts for a specified duration.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Scopes lockouts to a given username and client IP address (but this is configurable via an injectable function).","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Note that ","type":"text"},{"text":"each","type":"text","marks":[{"type":"strong"}]},{"text":" attempt can be separated in time by the specified interval, so a 5 minute interval does not mean all the attempts must occur within 5 minutes, but could occur over a period as long as 5 times the number of attempts.","type":"text"}]},{"type":"paragraph","content":[{"text":"Once an account locks, an \"AccountLocked\" event is signaled, and the new default configuration maps this event to the \"AccountLocked\" classified error. If your installation pre-dates this feature, you will likely want to map that event to whichever classified error reporting condition you want to expose to the user.","type":"text"}]},{"type":"paragraph","content":[{"text":"See ","type":"text"},{"text":"AccountLockoutManagement","type":"text","marks":[{"type":"link","attrs":{"href":"https://shibboleth.atlassian.net/wiki/spaces/IDP5/pages/3199511437"}}]},{"text":" for information on the administrative flow that allows management of lockout state.","type":"text"}]}]},{"type":"expand","attrs":{"title":"Custom Back-Ends"},"content":[{"type":"paragraph","content":[{"text":"Creating a new back-end involves supplying a new implementation of the ","type":"text"},{"text":"CredentialValidator","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.authn.CredentialValidator"}}]},{"text":" interface, usually by inheriting from the ","type":"text"},{"text":"net.shibboleth.idp.authn.AbstractUsernamePasswordCredentialValidator","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.authn.AbstractUsernamePasswordCredentialValidator"}}]},{"text":" class.","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Reference","type":"text"}]},{"type":"expand","attrs":{"title":"Beans"},"content":[{"type":"paragraph","content":[{"text":"The beans defined in or for use in ","type":"text"},{"text":"authn/password-authn-config.xml","type":"text","marks":[{"type":"em"}]},{"text":" follow:","type":"text"}]},{"type":"table","attrs":{"layout":"full-width","localId":"fe7ab4d4-9edd-4be2-a4f2-6968b65917a6"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[456.0]},"content":[{"type":"paragraph","content":[{"text":"Bean ID / Type","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[805.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[456.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.authn.Password.Validators","type":"text"}]},{"type":"paragraph","content":[{"text":"List","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.List?module=java.sql"}}]},{"text":"<","type":"text"},{"text":"CredentialValidator","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.authn.CredentialValidator"}}]},{"text":">","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[805.0]},"content":[{"type":"paragraph","content":[{"text":"Defines the set of validator plugins to use","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[456.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.LDAPValidator","type":"text"}]},{"type":"paragraph","content":[{"text":"LDAPCredentialValidator","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.authn.impl.LDAPCredentialValidator"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[805.0]},"content":[{"type":"paragraph","content":[{"text":"Parent bean for referencing or defining LDAP validation","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[456.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.KerberosValidator","type":"text"}]},{"type":"paragraph","content":[{"text":"KerberosCredentialValidator","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.authn.impl.KerberosCredentialValidator"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[805.0]},"content":[{"type":"paragraph","content":[{"text":"Parent bean for referencing or defining Kerberos validation","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[456.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.JAASValidator","type":"text"}]},{"type":"paragraph","content":[{"text":"JAASCredentialValidator","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.authn.impl.JAASCredentialValidator"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[805.0]},"content":[{"type":"paragraph","content":[{"text":"Parent bean for referencing or defining JAAS validation","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[456.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.HTPasswdValidator","type":"text"}]},{"type":"paragraph","content":[{"text":"HTPasswdCredentialValidator","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.authn.impl.HTPasswdCredentialValidator"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[805.0]},"content":[{"type":"paragraph","content":[{"text":"Parent bean for referencing or defining htpasswd file validation","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[456.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.authn.Password.Transforms","type":"text"}]},{"type":"paragraph","content":[{"text":"Pair","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-shared.cgi/net.shibboleth.shared.collection.Pair"}}]},{"text":"<","type":"text"},{"text":"String","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.lang.String?module=java.sql"}}]},{"text":",","type":"text"},{"text":"String","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.lang.String?module=java.sql"}}]},{"text":">","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[805.0]},"content":[{"type":"paragraph","content":[{"text":"Pairs of regular expressions and replacement expressions to apply to the username before validating it","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[456.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.StorageBackedAccountLockoutManager","type":"text"}]},{"type":"paragraph","content":[{"text":"StorageBackedAccountLockoutManager","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.authn.impl.StorageBackedAccountLockoutManager"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[805.0]},"content":[{"type":"paragraph","content":[{"text":"Parent bean for declaring storage-backed account lockout with appropriate defaults","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[456.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.authn.Password.AccountLockoutManager","type":"text"}]},{"type":"paragraph","content":[{"text":"AccountLockoutManager","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net.shibboleth.idp.authn.AccountLockoutManager"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[805.0]},"content":[{"type":"paragraph","content":[{"text":"A lockout manager that, if defined, will enable account lockout feature","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[456.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.authn.Password.ClassifiedMessageMap","type":"text"}]},{"type":"paragraph","content":[{"text":"Map","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.Map?module=java.sql"}}]},{"text":"<","type":"text"},{"text":"String","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.lang.String?module=java.sql"}}]},{"text":",","type":"text"},{"text":"List","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.List?module=java.sql"}}]},{"text":"<","type":"text"},{"text":"String","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.lang.String?module=java.sql"}}]},{"text":">>","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[805.0]},"content":[{"type":"paragraph","content":[{"text":"A map between defined error/warning conditions and events and implementation-specific message fragments to map to them.","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[456.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.authn.Password.resultCachingPredicate","type":"text"}]},{"type":"paragraph","content":[{"text":"Predicate","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.function.Predicate?module=java.sql"}}]},{"text":"<","type":"text"},{"text":"ProfileRequestContext","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.profile.context.ProfileRequestContext"}}]},{"text":">","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[805.0]},"content":[{"type":"paragraph","content":[{"text":"An optional bean that can be defined to control whether to preserve the authentication result in an IdP session","type":"text"}]}]}]}]}]},{"type":"expand","attrs":{"title":"Flow-Specific Properties"},"content":[{"type":"paragraph","content":[{"text":"The flow-specific properties usable via ","type":"text"},{"text":"authn/authn.properties","type":"text","marks":[{"type":"em"}]},{"text":" are:","type":"text"}]},{"type":"table","attrs":{"layout":"full-width","localId":"9b3e35c7-e7b3-4ea1-a395-8bbccc096538"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[387.0]},"content":[{"type":"paragraph","content":[{"text":"Property","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[270.0]},"content":[{"type":"paragraph","content":[{"text":"Default","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[604.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[387.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.Password.requireAll","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[270.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[604.0]},"content":[{"type":"paragraph","content":[{"text":"Whether all validators must succeed or just one","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[387.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.Password.removeAfterValidation","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[270.0]},"content":[{"type":"paragraph","content":[{"text":"true","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[604.0]},"content":[{"type":"paragraph","content":[{"text":"Whether to remove the object holding the password from the request's active state after validating it (to avoid it being preserved in the session any longer than needed)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[387.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.Password.retainAsPrivateCredential","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[270.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[604.0]},"content":[{"type":"paragraph","content":[{"text":"Whether to keep the password around as a private \"credential\" in the Java Subject for use in later stages such as attribute resolution","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[387.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.Password.trim","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[270.0]},"content":[{"type":"paragraph","content":[{"text":"true","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[604.0]},"content":[{"type":"paragraph","content":[{"text":"Whether to trim leading and trailing whitespace from the username before validating it","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[387.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.Password.lowercase","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[270.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[604.0]},"content":[{"type":"paragraph","content":[{"text":"Whether to lowercase the username before validating it","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[387.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.Password.uppercase","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[270.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[604.0]},"content":[{"type":"paragraph","content":[{"text":"Whether to uppercase the username before validating it","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[387.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.Password.matchExpression","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[270.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[604.0]},"content":[{"type":"paragraph","content":[{"text":"Regular expression to apply before accepting username","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[387.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.Password.usernameFieldName","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[270.0]},"content":[{"type":"paragraph","content":[{"text":"j_username","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[604.0]},"content":[{"type":"paragraph","content":[{"text":"Name of the username field in the form","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[387.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.Password.passwordFieldName","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[270.0]},"content":[{"type":"paragraph","content":[{"text":"j_password","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[604.0]},"content":[{"type":"paragraph","content":[{"text":"Name of the password field in the form","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[387.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.Password.ssoBypassFieldName","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[270.0]},"content":[{"type":"paragraph","content":[{"text":"donotcache","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[604.0]},"content":[{"type":"paragraph","content":[{"text":"Name of the form field signaling to avoid caching the authentication result for SSO","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[387.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.Password.errorMessageFunction ","type":"text"},{"text":"5.1","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[270.0]},"content":[{"type":"paragraph","content":[{"text":"DefaultPasswordErrorFunction","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[604.0]},"content":[{"type":"paragraph","content":[{"text":"Overrides Function<","type":"text"},{"text":"ProfileRequestContext","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.profile.context.ProfileRequestContext"}}]},{"text":",String> to produce error message to render in login form, this optionally replaces the ","type":"text"},{"text":"login-error.vm","type":"text","marks":[{"type":"em"}]},{"text":" template in older versions","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[387.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.Password.genericMessageID ","type":"text"},{"text":"5.1","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[270.0]},"content":[{"type":"paragraph","content":[{"text":"authn","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[604.0]},"content":[{"type":"paragraph","content":[{"text":"If set, any “unclassified” errors are rendered using this message key to prevent exposing internal exception messages/details. If not set, the original logic from older releases is used and exception messages may be returned by the default error message function","type":"text"}]}]}]}]}]},{"type":"expand","attrs":{"title":"General Properties"},"content":[{"type":"paragraph","content":[{"text":"The general properties configuring this flow via ","type":"text"},{"text":"authn/authn.properties","type":"text","marks":[{"type":"em"}]},{"text":" are:","type":"text"}]},{"type":"table","attrs":{"layout":"full-width","localId":"0d5a7aa1-e2ce-4b81-a7c1-7a7e878a4b86"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[451.0]},"content":[{"type":"paragraph","content":[{"text":"Property","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[368.0]},"content":[{"type":"paragraph","content":[{"text":"Default","type":"text"}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[442.0]},"content":[{"type":"paragraph","content":[{"text":"Description","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[451.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.Password.order","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[368.0]},"content":[{"type":"paragraph","content":[{"text":"1000","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[442.0]},"content":[{"type":"paragraph","content":[{"text":"Flow priority relative to other enabled login flows (lower is \"higher\" in priority)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[451.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.Password.nonBrowserSupported","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[368.0]},"content":[{"type":"paragraph","content":[{"text":"true","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[442.0]},"content":[{"type":"paragraph","content":[{"text":"Whether the flow should handle non-browser request profiles (e.g., ECP)","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[451.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.Password.passiveAuthenticationSupported","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[368.0]},"content":[{"type":"paragraph","content":[{"text":"true","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[442.0]},"content":[{"type":"paragraph","content":[{"text":"Whether the flow allows for passive authentication","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[451.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.Password.forcedAuthenticationSupported","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[368.0]},"content":[{"type":"paragraph","content":[{"text":"true","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[442.0]},"content":[{"type":"paragraph","content":[{"text":"Whether the flow supports forced authentication","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[451.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.Password.proxyRestrictionsEnforced","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[368.0]},"content":[{"type":"paragraph","content":[{"text":"%{idp.authn.enforceProxyRestrictions:true}","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[442.0]},"content":[{"type":"paragraph","content":[{"text":"Whether the flow enforces upstream IdP-imposed restrictions on proxying","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[451.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.Password.proxyScopingEnforced","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[368.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[442.0]},"content":[{"type":"paragraph","content":[{"text":"Whether the flow considers itself to be proxying, and therefore enforces SP-signaled restrictions on proxying","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[451.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.Password.discoveryRequired","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[368.0]},"content":[{"type":"paragraph","content":[{"text":"false","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[442.0]},"content":[{"type":"paragraph","content":[{"text":"Whether to invoke IdP-discovery prior to running flow","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[451.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.Password.lifetime","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[368.0]},"content":[{"type":"paragraph","content":[{"text":"%{idp.authn.defaultLifetime:PT1H}","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[442.0]},"content":[{"type":"paragraph","content":[{"text":"Default lifetime of results produced by this flow","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[451.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.Password.inactivityTimeout","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[368.0]},"content":[{"type":"paragraph","content":[{"text":"%{idp.authn.defaultTimeout:PT30M}","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[442.0]},"content":[{"type":"paragraph","content":[{"text":"Default inactivity timeout of results produced by this flow","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[451.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.Password.lifetimeStrategy ","type":"text"},{"text":"5.2","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[368.0]},"content":[{"type":"paragraph","content":[{"text":"Function returning null","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[442.0]},"content":[{"type":"paragraph","content":[{"text":"Bean ID of Function<","type":"text"},{"text":"ProfileRequestContext","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.profile.context.ProfileRequestContext"}}]},{"text":",Duration> overriding a specific result’s lifetime","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[451.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.Password.inactivityTimeoutStrategy ","type":"text"},{"text":"5.2","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[368.0]},"content":[{"type":"paragraph","content":[{"text":"Function returning null","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[442.0]},"content":[{"type":"paragraph","content":[{"text":"Bean ID of Function<","type":"text"},{"text":"ProfileRequestContext","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.profile.context.ProfileRequestContext"}}]},{"text":",Duration> overriding a specific result’s inactivity timeout","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[451.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.Password.reuseCondition","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[368.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.Conditions.TRUE","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[442.0]},"content":[{"type":"paragraph","content":[{"text":"Bean ID of Predicate<","type":"text"},{"text":"ProfileRequestContext","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.profile.context.ProfileRequestContext"}}]},{"text":"> controlling result reuse for SSO","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[451.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.Password.activationCondition","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[368.0]},"content":[{"type":"paragraph","content":[{"text":"shibboleth.Conditions.TRUE","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[442.0]},"content":[{"type":"paragraph","content":[{"text":"Bean ID of Predicate<","type":"text"},{"text":"ProfileRequestContext","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.profile.context.ProfileRequestContext"}}]},{"text":"> determining whether flow is usable for request","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[451.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.Password.subjectDecorator","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[368.0]},"content":[{"type":"paragraph","content":[{"type":"hardBreak"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[442.0]},"content":[{"type":"paragraph","content":[{"text":"Bean ID of ","type":"text"},{"text":"BiConsumer","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.util.function.BiConsumer"}}]},{"text":"<","type":"text"},{"text":"ProfileRequestContext","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org.opensaml.profile.context.ProfileRequestContext"}}]},{"text":",","type":"text"},{"text":"Subject","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/javax.security.auth.Subject"}}]},{"text":"> for subject customization","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[451.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.Password.supportedPrincipals","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[368.0]},"content":[{"type":"paragraph","content":[{"text":"(see below)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[442.0]},"content":[{"type":"paragraph","content":[{"text":"Comma-delimited list of protocol-specific ","type":"text"},{"text":"Principal","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.security.Principal"}}]},{"text":" strings associated with flow","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[451.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.Password.addDefaultPrincipals","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[368.0]},"content":[{"type":"paragraph","content":[{"text":"true","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[442.0]},"content":[{"type":"paragraph","content":[{"text":"Whether to auto-attach the preceding set of ","type":"text"},{"text":"Principal","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/java.security.Principal"}}]},{"text":" objects to each ","type":"text"},{"text":"Subject","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/javax.security.auth.Subject"}}]},{"text":" produced by this flow","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[451.0]},"content":[{"type":"paragraph","content":[{"text":"idp.authn.Password.c14n.flows ","type":"text"},{"text":"5.2","type":"text","marks":[{"type":"subsup","attrs":{"type":"sup"}}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[368.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[442.0]},"content":[{"type":"paragraph","content":[{"text":"Comma-delimited list of c14n methods (beans) to run after use of this login flow","type":"text"}]}]}]}]},{"type":"paragraph","content":[{"text":"Most of the flows, including this one, default to describing themselves in terms of \"password\"-based authentication, so the ","type":"text"},{"text":"supportedPrincipals","type":"text","marks":[{"type":"code"}]},{"text":" property defaults to the following XML:","type":"text"}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n \n \n \n","type":"text"}]},{"type":"paragraph","content":[{"text":"In property form, this is expressed as (note especially the trailing commas, which MUST be there):","type":"text"}]},{"type":"codeBlock","content":[{"text":"idp.authn.Password.supportedPrincipals = \\\n saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport, \\\n saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:Password, \\\n saml1/urn:oasis:names:tc:SAML:1.0:am:password","type":"text"}]}]},{"type":"expand","attrs":{"title":"Flow Descriptor XML"},"content":[{"type":"paragraph","content":[{"text":"To replace the internally defined flow descriptor bean, the following XML is required:","type":"text"}]},{"type":"codeBlock","attrs":{"language":"xml"},"content":[{"text":"\n \n \n \n \n \n \n \n","type":"text"}]},{"type":"paragraph","content":[{"text":"In older versions and upgraded systems, this list is defined in ","type":"text"},{"text":"conf/authn/general-authn.xml","type":"text","marks":[{"type":"em"}]},{"text":". In newer installs, no default version of the list is provided and it may simply be placed in ","type":"text"},{"text":"conf/global.xml","type":"text","marks":[{"type":"em"}]},{"text":" if needed.","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Notes","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"idp.authn.Password.retainAsPrivateCredential","type":"text","marks":[{"type":"strong"}]},{"text":" property should be used with caution, as it retains the password and makes it available in plaintext form within server memory at various stages. When the session is written to storage, the password is encrypted with the secret key used by the IdP for other encryption of data to itself, but it will be decrypted and back in memory at various times when the session is accessed or updated.","type":"text"}]}],"version":1}

Browser not supported