<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Wingdings;
panose-1:5 0 0 0 0 0 0 0 0 0;}
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
{mso-style-priority:34;
margin-top:0in;
margin-right:0in;
margin-bottom:0in;
margin-left:.5in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
/* List Definitions */
@list l0
{mso-list-id:1438868468;
mso-list-type:hybrid;
mso-list-template-ids:332667942 -241169706 67698691 67698693 67698689 67698691 67698693 67698689 67698691 67698693;}
@list l0:level1
{mso-level-number-format:bullet;
mso-level-text:-;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Calibri",sans-serif;
mso-fareast-font-family:Calibri;}
@list l0:level2
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level3
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l0:level4
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l0:level5
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level6
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
@list l0:level7
{mso-level-number-format:bullet;
mso-level-text:\F0B7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Symbol;}
@list l0:level8
{mso-level-number-format:bullet;
mso-level-text:o;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:"Courier New";}
@list l0:level9
{mso-level-number-format:bullet;
mso-level-text:\F0A7;
mso-level-tab-stop:none;
mso-level-number-position:left;
text-indent:-.25in;
font-family:Wingdings;}
ol
{margin-bottom:0in;}
ul
{margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Good morning,<o:p></o:p></p>
<p class="MsoNormal">I’m working on modifying the Shibboleth-Totp plugin that was developed and is available on github so that it actually works with the MFA flow that’s available to the IDP now. The way the plugin was originally developed, it runs its own
password flow, and it needs to be referenced directly in idp.properties. It was also written to use its own seed fetcher, which seems counter intuitive when the IdP has the attribute resolver available to it so I don’t see a point in reinventing the wheel
creating new directory connections etc.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">My question revolves around calling the attribute resolver, I’ve included some code below. I currently have it working, but I want to make sure it’s working correctly based on the way the IdP is plumbed. Many of the examples available
use script provided via XML. There’s not much out there for actually programming plugins.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">High level: The flow is called and it looks at the c14n principal name from the profileContext that’s passed to it. It then hands off to an ‘AttributeSourcedSeedFetcher’ (code provided), which loads the username into an AttributeResolutionContext.<o:p></o:p></p>
<p class="MsoNormal">The AttributeResolutionContext needs the AttributeResolverService when resolveAtributes is called. I’ve passed that in via a bean. I then get the attribute, and remove the subcontext for the AttributeResolverContext.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks all<o:p></o:p></p>
<p class="MsoNormal">Joe Fischetti<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Note I’ve stripped out the unnecessary content below.<o:p></o:p></p>
<p class="MsoNormal">Username is passed in upstream via the profileRequestContext. attrRes and seedAttribute are passed in via the bean below.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">------------------------------------------<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="text-indent:.5in">AttributeResolutionContext resCtx = (AttributeResolutionContext)profileRequestContext.getSubcontext(AttributeResolutionContext.class, true);<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in">resCtx.setPrincipal(username);<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> //Define the arraylist of attribute values to pass into the resolver<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in">ArrayList<String> seedAttributeList = new ArrayList<String>();<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in">seedAttributeList.add(seedAttribute);<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> //Add the attribute names to the resolver<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in">resCtx.setRequestedIdPAttributeNames(seedAttributeList);<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> //Resolve the attributes<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in">resCtx.resolveAttributes(attrRes);<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> //Get the results<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in">Map<String,IdPAttribute> attributeResults = resCtx.getResolvedIdPAttributes();<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> //Get just the attribute we care about (This can be condensed into the line above)<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in">IdPAttribute attribute = attributeResults.get(seedAttribute);<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> //Parse the values<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in">if (attribute != null) {<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:1.0in">//Run through the returned values and act<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in">}<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="text-indent:.5in">else{<o:p></o:p></p>
<p class="MsoNormal" style="margin-left:.5in;text-indent:.5in">//Handle it<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in">}<o:p></o:p></p>
<p class="MsoNormal"> <o:p></o:p></p>
<p class="MsoNormal"> //Remove the subcontext for the resolver (is this the ‘unpinning’?)<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in">profileRequestContext.removeSubcontext(resCtx);<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">---------------------------------------<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><!-- For AttributeSourcedSeedFetcher <o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in">Pass in the attrRes, and the seed attribute from the config file--><o:p></o:p></p>
<p class="MsoNormal"><bean id="shibboleth.totp.seedfetcher" class="net.kvak.shibboleth.totpauth.authn.impl.seed.AttributeSourcedSeedFetcher"<o:p></o:p></p>
<p class="MsoNormal" style="text-indent:.5in">p:attrRes-ref="shibboleth.AttributeResolverService"><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="text-indent:.5in"><constructor-arg ref="shibboleth.authn.seedAttribute" /><o:p></o:p></p>
<p class="MsoNormal"></bean><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="background:white"><b><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#7C7C5F">Joe Fischetti</span></b><span style="font-size:10.5pt;font-family:"Arial",sans-serif;color:#212121"><o:p></o:p></span></p>
<p class="MsoNormal" style="background:white"><b><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#212121">Linux System Administrator</span></b><span style="font-size:10.5pt;font-family:"Arial",sans-serif;color:#212121"><o:p></o:p></span></p>
<p class="MsoNormal" style="background:white"><b><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#212121">Marist College<o:p></o:p></span></b></p>
<p class="MsoNormal" style="background:white"><span style="font-size:10.5pt;font-family:"Arial",sans-serif;color:#212121"><o:p> </o:p></span></p>
<p class="MsoNormal" style="background:white"><b><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#336699">E-mail: </span></b><span style="font-size:8.0pt;font-family:"Arial",sans-serif;color:#212121"><a href="mailto:joseph.fischetti@marist.edu" target="_blank"><span style="font-size:10.0pt;font-family:"Verdana",sans-serif;color:#555555">joseph.fischetti@marist.edu</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>