OIDC 0.9 extension

[Jim Fox]

>
> My best guess (I'll really verify it on monday) that it would work if you asked the acr as essential claim instead of voluntary. The implementation most likely lacks the logic for picking the value based on requested acr claim in voluntary case. Sorry about that, I'll add it on monday if that's the case. Nicely spotted if so, thanks.

I was asking essential, as the log shows.  It might be that doExecute of ProcessRequestedAuthnContext.java skips the essential part when an acrValue is requested.


I tried setting acrRequestAlwaysEssential="true' to OIDC.SSO and that resulted in:

(at flow selection)
[org.geant.idpextension.oidc.profile.impl.ProcessRequestedAuthnContext:168] - Profile Action ProcessRequestedAuthnContext: Located acr value https://refeds.org/profile/mfa in request
[org.geant.idpextension.oidc.profile.impl.ProcessRequestedAuthnContext:193] - Profile Action ProcessRequestedAuthnContext: Created requested principal context
[net.shibboleth.idp.authn.impl.PopulateAuthenticationContext:221] - Profile Action PopulateAuthenticationContext: Installed 2 potential authentication flows into AuthenticationContext
[net.shibboleth.idp.authn.impl.InitializeRequestedPrincipalContext:117] - Profile Action InitializeRequestedPrincipalContext: Leaving existing RequestedPrincipalContext in place
[net.shibboleth.idp.authn.impl.FilterFlowsByForcedAuthn:53] - Profile Action FilterFlowsByForcedAuthn: Request does not have forced authentication requirement, nothing to do
[net.shibboleth.idp.authn.impl.FilterFlowsByNonBrowserSupport:53] - Profile Action FilterFlowsByNonBrowserSupport: Request does not have non-browser requirement, nothing to do
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:395] - Profile Action SelectAuthenticationFlow: Specific principals requested with 'exact' operator: [AuthenticationContextClassReferencePrincipal{authnContextClassReference=https://refeds.org/profile/mfa}]
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:411] - Profile Action SelectAuthenticationFlow: No active results available, selecting an inactive flow
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:432] - Profile Action SelectAuthenticationFlow: Checking for an inactive flow compatible with operator 'exact' and principal 'https://refeds.org/profile/mfa'

[net.shibboleth.idp.authn.principal.PrincipalEvalPredicateFactoryRegistry:86] - Registry failed to locate predicate factory for principal type 'class org.geant.idpextension.oidc.authn.principal.AuthenticationContextClassReferencePrincipal' and operator 'exact'
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:446] - Profile Action SelectAuthenticationFlow: Configuration does not support requested principal evaluation with operator 'exact' and type 'class org.geant.idpextension.oidc.authn.principal.AuthenticationContextClassReferencePrincipal'
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:453] - Profile Action SelectAuthenticationFlow: None of the potential authentication flows can satisfy the request
[org.geant.idpextension.oidc.profile.impl.AbstractBuildErrorResponseFromEvent:149] - Profile Action BuildAuthenticationErrorResponseFromEvent: No mapped event found for RequestUnsupported, creating general invalid_request

In global-oidc.xml I have

     <bean id="shibboleth.OIDCAuthnContextClassReference"
         class="org.geant.idpextension.oidc.authn.principal.AuthenticationContextClassReferencePrincipal" abstract="true" />

and in general-authn.xml I have

        <bean id="authn/Password" parent="shibboleth.AuthenticationFlow"
                 p:passiveAuthenticationSupported="true"
                 p:forcedAuthenticationSupported="true" >
             <property name="supportedPrincipals">
                 <util:list>
                       ...
                      <bean parent="shibboleth.OIDCAuthnContextClassReference"
                         c:classRef="password" />
                </util:list>
             </property>
         </bean>

and

         <bean id="authn/MFA" parent="shibboleth.AuthenticationFlow"
                p:forcedAuthenticationSupported="true"
                p:nonBrowserSupported="false" >

             <property name="supportedPrincipals">
                 <util:list>
                  ...
             <bean parent="shibboleth.OIDCAuthnContextClassReference"
                    c:classRef="password" />
             <bean parent="shibboleth.OIDCAuthnContextClassReference"
                    c:classRef="https://refeds.org/profile/mfa" />
                 </util:list>
             </property>
         </bean>

and in authn/authn-comparison-oidc.xml

     <bean id="shibboleth.OIDCAuthnMethodExact" class="net.shibboleth.utilities.java.support.collection.Pair"
         p:first="#{ T(org.geant.idpextension.oidc.authn.principal.AuthenticationContextClassReferencePrincipal) }" p:second="exact"/>

     <util:map id="shibboleth.AuthnComparisonRules">

         <!-- Exact matching, should be left alone to avoid tricking the IdP into behaving incorrectly. -->
         <entry key-ref="shibboleth.SAMLAuthnMethodExact" value-ref="shibboleth.ExactMatchFactory"/>
         <entry key-ref="shibboleth.SAMLACClassRefExact" value-ref="shibboleth.ExactMatchFactory"/>
         <entry key-ref="shibboleth.SAMLACDeclRefExact" value-ref="shibboleth.ExactMatchFactory"/>
         <!-- We map OIDC exact match to exact factory -->
         <entry key-ref="shibboleth.OIDCAuthnMethodExact" value-ref="shibboleth.ExactMatchFactory"/>

         <!-- Minimum matching, leave to allow degeneration into exact, or replace with custom rules. -->
         <entry key-ref="shibboleth.SAMLACClassRefMinimum" value-ref="shibboleth.ExactMatchFactory"/>
         <entry key-ref="shibboleth.SAMLACDeclRefMinimum" value-ref="shibboleth.ExactMatchFactory"/>

         <!-- Maximum matching, leave to allow degeneration into exact, or replace with custom rules. -->
         <entry key-ref="shibboleth.SAMLACClassRefMaximum" value-ref="shibboleth.ExactMatchFactory"/>
         <entry key-ref="shibboleth.SAMLACDeclRefMaximum" value-ref="shibboleth.ExactMatchFactory"/>

         <!-- Better matching, refers to empty ruleset that has to be populated to work. -->
         <entry key-ref="shibboleth.SAMLACClassRefBetter" value-ref="shibboleth.BetterClassRefMatchFactory"/>
         <entry key-ref="shibboleth.SAMLACDeclRefBetter" value-ref="shibboleth.BetterDeclRefMatchFactory"/>

     </util:map>

and in authn-comparison.xml

   <import resource="authn-comparison-oidc.xml" />


Jim


>
> BR Janne
>
> ----- Original Message -----
> From: "Jim Fox" <fox at washington.edu>
> To: "dev" <dev at shibboleth.net>
> Sent: Friday, 29 March, 2019 20:01:22
> Subject: Re: OIDC 0.9 extension
>
>> ps. This is handled also as an exercise in our training material on https://wiki.eduuni.fi/display/CSCHAKA/181211-12+@+Shibboleth+OIDC+Extension+Tutorial
>
> That's a nice resource.
>
> I get an acr claim now, but it is always "password".  Even though it does execute the mfa flow.
>
> I only use one flow: authn/MFA, and that contains
>
>        <bean parent="shibboleth.OIDCAuthnContextClassReference"
>            c:classRef="https://refeds.org/profile/mfa" />
>
> In that mfa flow I first do "authn/Password", and when that returns I either stop there or procede to "authn/uwduo" (our duo login), which also contains the above bean reference.
>
>
> In the process.log,
>
> [org.geant.idpextension.oidc.profile.impl.ProcessRequestedAuthnContext:168] - Profile Action ProcessRequestedAuthnContext: Located acr value {"id_token":{"acr": in request
> [org.geant.idpextension.oidc.profile.impl.ProcessRequestedAuthnContext:168] - Profile Action ProcessRequestedAuthnContext: Located acr value {"essential": in request
> [org.geant.idpextension.oidc.profile.impl.ProcessRequestedAuthnContext:168] - Profile Action ProcessRequestedAuthnContext: Located acr value true,"value": in request
> [org.geant.idpextension.oidc.profile.impl.ProcessRequestedAuthnContext:168] - Profile Action ProcessRequestedAuthnContext: Located acr value "https://refeds.org/profile/mfa"}}} in request
> [org.geant.idpextension.oidc.profile.impl.ProcessRequestedAuthnContext:199] - Profile Action ProcessRequestedAuthnContext: Created preferred principal context
>
> Then, right after duo completion:
>
> [net.shibboleth.idp.authn.duo.impl.ValidateDuoWebResponse:200] - Profile Action ValidateDuoWebResponse: Duo authentication succeeded for 'fox'
> [org.geant.idpextension.oidc.profile.impl.SetAuthenticationContextClassReferenceToResponseContext:141] - Profile Action SetAuthenticationContextClassReferenceToResponseContext: Setting acr based on performed flow
> [org.geant.idpextension.oidc.profile.impl.SetAuthenticationContextClassReferenceToResponseContext:145] - Profile Action SetAuthenticationContextClassReferenceToResponseContext: Setting acr to password
>
> Somewhere maybe I'm not setting something, however, my SAML responses always return the correct AuthnContextClassRef, but with OIDC the acr is always 'password'.
>
>
> Jim
> -- 
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net
> -- 
> To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net
>