IDP 3.3 MFA flow -- checking to see if an authn context class ref was requested

[Cantor, Scott]

On 12/5/16, 1:14 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:

> Trying to set things up such that, in the case that the SP requests Duo and Password (in that order), my IdP can
> handle things intelligently. If Both were requested and the user is eligible for Duo, I want to signal Duo. If both
> were requested and the user isn't Duo eligible, I'll let them through with Password. If the SP didn't request Duo at
> all, I'll let them through with Password. And if the SP only requested Duo, I'll either send them to a Duo flow or to
> another flow which displays an error stating they need to enroll for a Duo token.

You pretty much always want to start by running the Password flow of course, since that's the baseline. Assuming your first factor is always Password anyway.

Then you can branch to a script step and do your checking there.

> First, I see I can use the isAcceptable method (as included in the distributed example) to see if a requested
> method has been satisfied. But I'm curious, in this case, about requested methods that haven't been satisfied -
> namely Duo. How can I get a list of requested authentication context classes? I've looked at the MFA context and
> authentication context in the JavaDocs, but I don't see anything to help me in those.

What you really want to do is check individually whether the method(s) you want to support are or are not satisfied. Don't compare against what was requested. If you do that, you're limiting the request to "exact" whereas my way handles anything.

If you want to handle the most general case, you just run Password and then say "is that good enough?". If you want to go beyond that, you have to enumerate specific types you want to check for but you should still craft it in terms of "does this method satisfy the request?".

> Second, would it be easier for me to not use the MFA flow at all but rather check for Duo eligibility (by checking a
> user's attribute values) inside my duo.vm?

No, that is not easier. It's not even possible, without modifying the flow to resolve attributes. The MFA flow can be scripted to resolve attributes. The Duo flow doesn't do that.

-- Scott