OIDC 0.9 extension

[Janne Lauros]

My best guess (I'll really verify it on monday) that it would work if you asked the acr as essential claim instead of voluntary. The implementation most likely lacks the logic for picking the value based on requested acr claim in voluntary case. Sorry about that, I'll add it on monday if that's the case. Nicely spotted if so, thanks.

 BR Janne

----- Original Message -----
From: "Jim Fox" <fox at washington.edu>
To: "dev" <dev at shibboleth.net>
Sent: Friday, 29 March, 2019 20:01:22
Subject: Re: OIDC 0.9 extension

> ps. This is handled also as an exercise in our training material on https://wiki.eduuni.fi/display/CSCHAKA/181211-12+@+Shibboleth+OIDC+Extension+Tutorial

That's a nice resource.

I get an acr claim now, but it is always "password".  Even though it does execute the mfa flow.

I only use one flow: authn/MFA, and that contains

        <bean parent="shibboleth.OIDCAuthnContextClassReference"
            c:classRef="https://refeds.org/profile/mfa" />

In that mfa flow I first do "authn/Password", and when that returns I either stop there or procede to "authn/uwduo" (our duo login), which also contains the above bean reference.


In the process.log,

[org.geant.idpextension.oidc.profile.impl.ProcessRequestedAuthnContext:168] - Profile Action ProcessRequestedAuthnContext: Located acr value {"id_token":{"acr": in request
[org.geant.idpextension.oidc.profile.impl.ProcessRequestedAuthnContext:168] - Profile Action ProcessRequestedAuthnContext: Located acr value {"essential": in request
[org.geant.idpextension.oidc.profile.impl.ProcessRequestedAuthnContext:168] - Profile Action ProcessRequestedAuthnContext: Located acr value true,"value": in request
[org.geant.idpextension.oidc.profile.impl.ProcessRequestedAuthnContext:168] - Profile Action ProcessRequestedAuthnContext: Located acr value "https://refeds.org/profile/mfa"}}} in request
[org.geant.idpextension.oidc.profile.impl.ProcessRequestedAuthnContext:199] - Profile Action ProcessRequestedAuthnContext: Created preferred principal context

Then, right after duo completion:

[net.shibboleth.idp.authn.duo.impl.ValidateDuoWebResponse:200] - Profile Action ValidateDuoWebResponse: Duo authentication succeeded for 'fox'
[org.geant.idpextension.oidc.profile.impl.SetAuthenticationContextClassReferenceToResponseContext:141] - Profile Action SetAuthenticationContextClassReferenceToResponseContext: Setting acr based on performed flow
[org.geant.idpextension.oidc.profile.impl.SetAuthenticationContextClassReferenceToResponseContext:145] - Profile Action SetAuthenticationContextClassReferenceToResponseContext: Setting acr to password

Somewhere maybe I'm not setting something, however, my SAML responses always return the correct AuthnContextClassRef, but with OIDC the acr is always 'password'.


Jim
-- 
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net