Local SSO integration with IdP 5.1.1

[Mak, Steve]

Christopher,

I don't know if this helps, but this is how my IdP checks (after removing extra fluff for this email) for a proxy session in the MFA flow during our "checkFirstFactor" script

            // proxy logic
            nextFlow = 'authn/Password'

            authContext = input.getSubcontext("net.shibboleth.idp.authn.context.AuthenticationContext")
            mfaContext = authContext.getSubcontext("net.shibboleth.idp.authn.context.MultiFactorAuthenticationContext")

            for each (result in mfaContext.getActiveResults()) {
                flowId = result.getAuthenticationFlowId()
                if (flowId == 'authn/SAML') {
                    nextFlow = 'authn/SAML'
                }
            }

This is how we decided to check for previous auth flow types. We normally go to password flow unless their previous session went through our proxy flow.

- Steve

From: dev <dev-bounces at shibboleth.net> on behalf of Christopher Bongaarts via dev <dev at shibboleth.net>
Date: Tuesday, April 16, 2024 at 7:31 PM
To: Shib Dev <dev at shibboleth.net>
Cc: Christopher Bongaarts <cab at umn.edu>
Subject: Re: Local SSO integration with IdP 5.1.1
I think I'm close. Using this map chunk:

<entry key="authn/External">
             <bean parent="shibboleth.authn.MFA.Transition">
                 <property name="nextFlowStrategyMap">
                     <map>
                         <entry key="proceed" value="proceed" />
                         <entry key="*" value="authn/Password" />
                     </map>
                 </property>
             </bean>
         </entry>

yields the correct behavior when the external authn succeeds (MFA stops
and completes successfully).

When external authn fails, it correctly routes to the authn/Password
flow, but the password page shows an error/warning atop the
username/password form:

"User login was not successful or could not meet the requirements of the
requesting application."

which is the expected error message from the NoCredentials event that
the External flow returns if you don't give it a principal/Subject.  I'd
like to suppress this message in this case, but not sure the best way to
accomplish that.

On 4/16/2024 7:28 AM, Cantor, Scott wrote:
>> - if external flow was successful (got an AuthenticationResult), STOP -
>> we're done return success from MFA flow
> It's implicit. Not having a rule handling a transition completes the flow in whatever state it's in, success or not.
>
>> - else continue to next (formerly original) flow, authn/Password
> You either dispatch on the wildcard character or you catch specific events to route on, either way.
>
> -- Scott
>
>

--
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  https://urldefense.com/v3/__http://umn.edu/*cab__;fg!!IBzWLUs!W_HYeJSHy9FHUmVkkFn_PoLUOjYMGp_1VkSSHt1PYgeQBwAIGjW5VbrFF2HD1iu03YoJIq2oZPU7MQ$<https://urldefense.com/v3/__http:/umn.edu/*cab__;fg!!IBzWLUs!W_HYeJSHy9FHUmVkkFn_PoLUOjYMGp_1VkSSHt1PYgeQBwAIGjW5VbrFF2HD1iu03YoJIq2oZPU7MQ$>   %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%

--
To unsubscribe from this list send an email to dev-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20240417/b714ef39/attachment.htm>