[JIRA] (IDP-1862) Reuse MFA flow results if all possible methods have already been satisfied

[Keith Wessel (Jira)]

Keith Wessel ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=60ad392bb4624d00692388ed ) *created* an issue

Identity Provider ( https://shibboleth.atlassian.net/browse/IDP?atlOrigin=eyJpIjoiMDFjNjU5ZThjNTIyNDhiMzk0YzJiMTY4ZjVlNTBjN2UiLCJwIjoiaiJ9 ) / Improvement ( https://shibboleth.atlassian.net/browse/IDP-1862?atlOrigin=eyJpIjoiMDFjNjU5ZThjNTIyNDhiMzk0YzJiMTY4ZjVlNTBjN2UiLCJwIjoiaiJ9 ) IDP-1862 ( https://shibboleth.atlassian.net/browse/IDP-1862?atlOrigin=eyJpIjoiMDFjNjU5ZThjNTIyNDhiMzk0YzJiMTY4ZjVlNTBjN2UiLCJwIjoiaiJ9 ) Reuse MFA flow results if all possible methods have already been satisfied ( https://shibboleth.atlassian.net/browse/IDP-1862?atlOrigin=eyJpIjoiMDFjNjU5ZThjNTIyNDhiMzk0YzJiMTY4ZjVlNTBjN2UiLCJwIjoiaiJ9 )

Issue Type: Improvement Affects Versions: 4.1.2 Assignee: Scott Cantor ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=557058%3A5b78efc9-1379-42cc-a3f6-56c6ea3a0007 ) Components: Authentication Created: 17/Sep/21 1:01 PM Priority: Trivial Reporter: Keith Wessel ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=60ad392bb4624d00692388ed )

Per Paul Henson's suggested ReuseMFACondition bean posted to the users list, bake this in as a standard predicate. His code:

var result = false;
var logger = Java.type("org.slf4j.LoggerFactory").getLogger("authn_mfa_reuse");
var authnCtx = input.getSubcontext("net.shibboleth.idp.authn.context.AuthenticationContext");
if (authnCtx != null) {
var authn_result = authnCtx.getActiveResults().get("authn/MFA");
if (authn_result != null) {
var principals = authn_result.getSubject().getPrincipals();
principals.forEach(
function(principal) {
if (principal instanceof Java.type("net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal")) {
var name = principal.getName();
logger.debug("considering principal " + name);
if (name.equals("https://refeds.org/profile/mfa"))

{ logger.debug("authn/MFA flow reusable"); result = true; }

}
}
);
} else

{ logger.error("no authn/MFA result found"); }

} else

{ logger.error("AuthenticationContext is null"); }

logger.debug("returning " + result);
result;

Naturally, this would need to be generalized a bit more so as to not have teh Refeds MFA profile ACR hard-coded.

( https://shibboleth.atlassian.net/browse/IDP-1862#add-comment?atlOrigin=eyJpIjoiMDFjNjU5ZThjNTIyNDhiMzk0YzJiMTY4ZjVlNTBjN2UiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/IDP-1862#add-comment?atlOrigin=eyJpIjoiMDFjNjU5ZThjNTIyNDhiMzk0YzJiMTY4ZjVlNTBjN2UiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100177- sha1:149c709 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20210917/146d696f/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-8bb64c16-504f-4e69-b8bb-76ac1b6d4c5d
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20210917/146d696f/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-ab8c6d72-ccc3-4168-b5f0-d6738a6ef5f1
Type: image/png
Size: 457 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20210917/146d696f/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-8c2fb03e-824d-42f9-9cc1-0abc7d65a0ce
Type: image/png
Size: 563 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20210917/146d696f/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-44b45dc4-af30-42e1-8234-2c34b8866ecd
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20210917/146d696f/attachment-0007.png>