<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Aptos;
panose-1:2 11 0 4 2 2 2 2 2 4;}
@font-face
{font-family:Menlo;
panose-1:2 11 6 9 3 8 4 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:12.0pt;
font-family:"Aptos",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Aptos",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;
mso-ligatures:none;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt">Christopher,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">I don't know if this helps, but this is how my IdP checks (after removing extra fluff for this email) for a proxy session in the MFA flow during our "checkFirstFactor" script<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal" style="line-height:13.5pt;background:#1E1E1E"><span style="font-size:9.0pt;font-family:Menlo;color:#D4D4D4">
</span><span style="font-size:9.0pt;font-family:Menlo;color:#6A9955">// proxy logic</span><span style="font-size:9.0pt;font-family:Menlo;color:#D4D4D4"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:13.5pt;background:#1E1E1E"><span style="font-size:9.0pt;font-family:Menlo;color:#D4D4D4"> nextFlow =
</span><span style="font-size:9.0pt;font-family:Menlo;color:#CE9178">'authn/Password'</span><span style="font-size:9.0pt;font-family:Menlo;color:#D4D4D4"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:13.5pt;background:#1E1E1E"><span style="font-size:9.0pt;font-family:Menlo;color:#D4D4D4"><o:p> </o:p></span></p>
<p class="MsoNormal" style="line-height:13.5pt;background:#1E1E1E"><span style="font-size:9.0pt;font-family:Menlo;color:#D4D4D4"> authContext = input.getSubcontext(</span><span style="font-size:9.0pt;font-family:Menlo;color:#CE9178">"net.shibboleth.idp.authn.context.AuthenticationContext"</span><span style="font-size:9.0pt;font-family:Menlo;color:#D4D4D4">)<o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:13.5pt;background:#1E1E1E"><span style="font-size:9.0pt;font-family:Menlo;color:#D4D4D4"> mfaContext = authContext.getSubcontext(</span><span style="font-size:9.0pt;font-family:Menlo;color:#CE9178">"net.shibboleth.idp.authn.context.MultiFactorAuthenticationContext"</span><span style="font-size:9.0pt;font-family:Menlo;color:#D4D4D4">)<o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:13.5pt;background:#1E1E1E"><span style="font-size:9.0pt;font-family:Menlo;color:#D4D4D4"><o:p> </o:p></span></p>
<p class="MsoNormal" style="line-height:13.5pt;background:#1E1E1E"><span style="font-size:9.0pt;font-family:Menlo;color:#D4D4D4">
</span><span style="font-size:9.0pt;font-family:Menlo;color:#569CD6">for</span><span style="font-size:9.0pt;font-family:Menlo;color:#D4D4D4"> each (result in mfaContext.getActiveResults()) {<o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:13.5pt;background:#1E1E1E"><span style="font-size:9.0pt;font-family:Menlo;color:#D4D4D4"> flowId = result.getAuthenticationFlowId()<o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:13.5pt;background:#1E1E1E"><span style="font-size:9.0pt;font-family:Menlo;color:#D4D4D4">
</span><span style="font-size:9.0pt;font-family:Menlo;color:#569CD6">if</span><span style="font-size:9.0pt;font-family:Menlo;color:#D4D4D4"> (flowId ==
</span><span style="font-size:9.0pt;font-family:Menlo;color:#CE9178">'authn/SAML'</span><span style="font-size:9.0pt;font-family:Menlo;color:#D4D4D4">) {<o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:13.5pt;background:#1E1E1E"><span style="font-size:9.0pt;font-family:Menlo;color:#D4D4D4"> nextFlow =
</span><span style="font-size:9.0pt;font-family:Menlo;color:#CE9178">'authn/SAML'</span><span style="font-size:9.0pt;font-family:Menlo;color:#D4D4D4"><o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:13.5pt;background:#1E1E1E"><span style="font-size:9.0pt;font-family:Menlo;color:#D4D4D4"> }<o:p></o:p></span></p>
<p class="MsoNormal" style="line-height:13.5pt;background:#1E1E1E"><span style="font-size:9.0pt;font-family:Menlo;color:#D4D4D4"> }<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">This is how we decided to check for previous auth flow types. We normally go to password flow unless their previous session went through our proxy flow.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt">- Steve<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt"><o:p> </o:p></span></p>
<div id="mail-editor-reference-message-container">
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin-bottom:12.0pt"><b><span style="color:black">From:
</span></b><span style="color:black">dev <dev-bounces@shibboleth.net> on behalf of Christopher Bongaarts via dev <dev@shibboleth.net><br>
<b>Date: </b>Tuesday, April 16, 2024 at 7:31</span><span style="font-family:"Arial",sans-serif;color:black"> </span><span style="color:black">PM<br>
<b>To: </b>Shib Dev <dev@shibboleth.net><br>
<b>Cc: </b>Christopher Bongaarts <cab@umn.edu><br>
<b>Subject: </b>Re: Local SSO integration with IdP 5.1.1<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:11.0pt">I think I'm close. Using this map chunk:<br>
<br>
<entry key="authn/External"><br>
<bean parent="shibboleth.authn.MFA.Transition"><br>
<property name="nextFlowStrategyMap"><br>
<map><br>
<entry key="proceed" value="proceed" /><br>
<entry key="*" value="authn/Password" /><br>
</map><br>
</property><br>
</bean><br>
</entry><br>
<br>
yields the correct behavior when the external authn succeeds (MFA stops <br>
and completes successfully).<br>
<br>
When external authn fails, it correctly routes to the authn/Password <br>
flow, but the password page shows an error/warning atop the <br>
username/password form:<br>
<br>
"User login was not successful or could not meet the requirements of the <br>
requesting application."<br>
<br>
which is the expected error message from the NoCredentials event that <br>
the External flow returns if you don't give it a principal/Subject. I'd <br>
like to suppress this message in this case, but not sure the best way to <br>
accomplish that.<br>
<br>
On 4/16/2024 7:28 AM, Cantor, Scott wrote:<br>
>> - if external flow was successful (got an AuthenticationResult), STOP -<br>
>> we're done return success from MFA flow<br>
> It's implicit. Not having a rule handling a transition completes the flow in whatever state it's in, success or not.<br>
><br>
>> - else continue to next (formerly original) flow, authn/Password<br>
> You either dispatch on the wildcard character or you catch specific events to route on, either way.<br>
><br>
> -- Scott<br>
><br>
><br>
<br>
-- <br>
%% Christopher A. Bongaarts %% cab@umn.edu %%<br>
%% OIT - Identity Management %% <a href="https://urldefense.com/v3/__http:/umn.edu/*cab__;fg!!IBzWLUs!W_HYeJSHy9FHUmVkkFn_PoLUOjYMGp_1VkSSHt1PYgeQBwAIGjW5VbrFF2HD1iu03YoJIq2oZPU7MQ$">
https://urldefense.com/v3/__http://umn.edu/*cab__;fg!!IBzWLUs!W_HYeJSHy9FHUmVkkFn_PoLUOjYMGp_1VkSSHt1PYgeQBwAIGjW5VbrFF2HD1iu03YoJIq2oZPU7MQ$</a> %%<br>
%% University of Minnesota %% +1 (612) 625-1809 %%<br>
<br>
-- <br>
To unsubscribe from this list send an email to dev-unsubscribe@shibboleth.net<o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</body>
</html>