OIDC 0.9 extension

[Jim Fox]

> ps. This is handled also as an exercise in our training material on https://wiki.eduuni.fi/display/CSCHAKA/181211-12+@+Shibboleth+OIDC+Extension+Tutorial

That's a nice resource.

I get an acr claim now, but it is always "password".  Even though it does execute the mfa flow.

I only use one flow: authn/MFA, and that contains

        <bean parent="shibboleth.OIDCAuthnContextClassReference"
            c:classRef="https://refeds.org/profile/mfa" />

In that mfa flow I first do "authn/Password", and when that returns I either stop there or procede to "authn/uwduo" (our duo login), which also contains the above bean reference.


In the process.log,

[org.geant.idpextension.oidc.profile.impl.ProcessRequestedAuthnContext:168] - Profile Action ProcessRequestedAuthnContext: Located acr value {"id_token":{"acr": in request
[org.geant.idpextension.oidc.profile.impl.ProcessRequestedAuthnContext:168] - Profile Action ProcessRequestedAuthnContext: Located acr value {"essential": in request
[org.geant.idpextension.oidc.profile.impl.ProcessRequestedAuthnContext:168] - Profile Action ProcessRequestedAuthnContext: Located acr value true,"value": in request
[org.geant.idpextension.oidc.profile.impl.ProcessRequestedAuthnContext:168] - Profile Action ProcessRequestedAuthnContext: Located acr value "https://refeds.org/profile/mfa"}}} in request
[org.geant.idpextension.oidc.profile.impl.ProcessRequestedAuthnContext:199] - Profile Action ProcessRequestedAuthnContext: Created preferred principal context

Then, right after duo completion:

[net.shibboleth.idp.authn.duo.impl.ValidateDuoWebResponse:200] - Profile Action ValidateDuoWebResponse: Duo authentication succeeded for 'fox'
[org.geant.idpextension.oidc.profile.impl.SetAuthenticationContextClassReferenceToResponseContext:141] - Profile Action SetAuthenticationContextClassReferenceToResponseContext: Setting acr based on performed flow
[org.geant.idpextension.oidc.profile.impl.SetAuthenticationContextClassReferenceToResponseContext:145] - Profile Action SetAuthenticationContextClassReferenceToResponseContext: Setting acr to password

Somewhere maybe I'm not setting something, however, my SAML responses always return the correct AuthnContextClassRef, but with OIDC the acr is always 'password'.


Jim