[JIRA] (IDP-1867) No attribute context available in profile request context for authenContextTranslationStrategyEx hook

Mon Oct 11 16:17:45 UTC 2021

Keith Wessel ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=60ad392bb4624d00692388ed ) *created* an issue

Identity Provider ( https://shibboleth.atlassian.net/browse/IDP?atlOrigin=eyJpIjoiNmFiNzU3ZDMxZGFkNDMzM2I1NmZkNzNjMjFiNDNiNDMiLCJwIjoiaiJ9 ) / Bug ( https://shibboleth.atlassian.net/browse/IDP-1867?atlOrigin=eyJpIjoiNmFiNzU3ZDMxZGFkNDMzM2I1NmZkNzNjMjFiNDNiNDMiLCJwIjoiaiJ9 ) IDP-1867 ( https://shibboleth.atlassian.net/browse/IDP-1867?atlOrigin=eyJpIjoiNmFiNzU3ZDMxZGFkNDMzM2I1NmZkNzNjMjFiNDNiNDMiLCJwIjoiaiJ9 ) No attribute context available in profile request context for authenContextTranslationStrategyEx hook ( https://shibboleth.atlassian.net/browse/IDP-1867?atlOrigin=eyJpIjoiNmFiNzU3ZDMxZGFkNDMzM2I1NmZkNzNjMjFiNDNiNDMiLCJwIjoiaiJ9 )

Issue Type: Bug Affects Versions: 4.1.2 Assignee: Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) Components: Profile Handling Created: 11/Oct/21 12:17 PM Priority: Trivial Reporter: Keith Wessel ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=60ad392bb4624d00692388ed )

IdP log reports:

2021-10-11 11:04:30,614 - DEBUG [net.shibboleth.idp.attribute.filter.AttributeFilte
rPolicy:153] - Attribute Filter Policy 'UnsuppressedUserAffilsToAnyone' Applying attribute filter policy to current set
of attributes: [uid, adfsProxyAuthnMethod]
...
2021-10-11 11:04:30,620 - DEBUG [net.shibboleth.idp.attribute.filter.AttributeRule:
192] - Attribute filtering engine '/AttributeFilterPolicyGroup:ShibbolethFilterPolicy/AttributeRule:_60a9db1947f3ae2b2ed
5ebc44dee14c3' Filter has permitted the release of 3 values for attribute 'adfsProxyAuthnMethod'

But when a simple attribute predicate tries to run as part of the function used for the authnContextTranslationStrategyEx hook:

2021-10-11 11:04:30,855 - WARN [net.shibboleth.idp.profile.logic.AbstractAttributeP
redicate:105] - No AttributeContext located for evaluation

And debug code in the function reports:
2021-10-11 11:04:30,828 - DEBUG [mfa_claim_to_acr:12] - Attribute context not found

The hook is configured like this in relying party config:
<bean parent="RelyingPartyByName" c:relyingPartyIds="%

{idp.saml-proxy.entityID}

"
p:responderIdLookupStrategy-ref="proxySPEntityIDStrategy">
<property name="profileConfigurations">
<list>
<bean parent="SAML2.SSO"
p:authnContextTranslationStrategyEx-ref="mfaClaimToACR" />
</list>
</property>
</bean>

The function and helpers map in global.xml are:
<bean id="mfaClaimToACR" parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript"
p:customObject-ref="mfaClaimToACRHelpersMap">
<constructor-arg>
<value>
<![CDATA[
var logger = Java.type("org.slf4j.LoggerFactory").getLogger("mfa_claim_to_acr");
var acr = null;

if (input.getSubcontext("net.shibboleth.idp.profile.context.RelyingPartyContext") == null)

{ logger.debug("Relying party context not found"); }

else

{ logger.debug("Relying party context found"); }

if (input.getSubcontext("net.shibboleth.idp.attribute.context.AttributeContext") == null)

{ logger.debug("Attribute context not found"); }

else

{ logger.debug("Attribute context found"); }

if (custom ["mfaAuthnClaimCondition"].test(input))

{ logger.debug("Found matching attribute value, authentication was MFA"); acr = custom["refedsMFAAuthnContext"]; }

else

{ logger.debug("No adfsProxyAuthnMethod attribute in response from IdP"); }

acr;
]]>
</value>
</constructor-arg>
</bean>

<util:map id="mfaClaimToACRHelpersMap">
<entry key="mfaAuthnClaimCondition">
<bean class="net.shibboleth.idp.profile.logic.SimpleAttributePredicate"
p:attributeContextLookupStrategy-ref="shibboleth.ChildLookup.PreRequestedAttributeContext"
p:useUnfilteredAttributes="true">
<property name="attributeValueMap">
<map>
<entry key="adfsProxyAuthnMethod">
<list>
<value> http://schemas.microsoft.com/claims/multipleauthn </value>
</list>
</entry>
</map>
</property>
</bean>
</entry>
<entry key="refedsMFAAuthnContext">
<list>
<bean parent="shibboleth.SAML2AuthnContextClassRef"
c:classRef="https://refeds.org/profile/mfa" />
</list>
</entry>
</util:map>

I'm aware that it might not be appropriate to return null for the authnContextClassRef if the simple attribute predicate returns false, but I was gong to tackle returning an appropriate value once I got the positive case to work.

( https://shibboleth.atlassian.net/browse/IDP-1867#add-comment?atlOrigin=eyJpIjoiNmFiNzU3ZDMxZGFkNDMzM2I1NmZkNzNjMjFiNDNiNDMiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/IDP-1867#add-comment?atlOrigin=eyJpIjoiNmFiNzU3ZDMxZGFkNDMzM2I1NmZkNzNjMjFiNDNiNDMiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100180- sha1:769424d )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20211011/73a43854/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-43477c96-5e1d-4f7b-97bf-115214690cae
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211011/73a43854/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-35d6ab5e-2869-42c6-9830-3265d13ffbdd
Type: image/png
Size: 563 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211011/73a43854/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-81e5b19b-5852-4111-9a53-1c74514f188c
Type: image/png
Size: 425 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211011/73a43854/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-47e32cce-ed81-4abd-8724-502a9d2ee913
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20211011/73a43854/attachment-0007.png>