IDP 3.3 MFA flow -- checking to see if an authn context class ref was requested

[Wessel, Keith]

Got it. So, isAcceptable looks at everything I've satisfied and everything in the request, factors in forcedAuth, and decides if I've met at least something that the SP will accept.

I have a basically working function now with only minor modifications to the example that shipped with 3.3. Now on to work on my flow that tells the user they need to go register for a Duo token.

Thanks again, Scott and Jim,
Keith


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Tuesday, December 06, 2016 12:28 PM
To: Shib Users <users at shibboleth.net>
Subject: RE: IDP 3.3 MFA flow -- checking to see if an authn context class ref was requested

Coincidentally I'm working on redoing my Duo integration using this code now, and I realized I was a little off with my suggestion, though the correct way is illustrated by the example script we shipped. The way you want to check if the factor(s) already completed are sufficient is with the MultiFactorAuthenticationContext's isAcceptable() method, it's a simpler check and it checks all the results for you plus handles ForceAuthn (by ignoring non-fresh results).

The sort of canonical handoff script (with Duo, or substitute anything else) is:

    <![CDATA[
        nextFlow = "authn/Duo";

        // Go to second factor if we have to.
        authCtx = input.getSubcontext("net.shibboleth.idp.authn.context.AuthenticationContext");
        mfaCtx = authCtx.getSubcontext("net.shibboleth.idp.authn.context.MultiFactorAuthenticationContext");
        if (mfaCtx.isAcceptable()) {
            nextFlow = null;
        }

        nextFlow;   // pass control to second factor or end with the first
    ]]>

Same as the example shipped, just without the attribute resolution illustrated.

I think at one point that was sort of abstracted out into a default behavior that I was calling a "completion function" but because so many people use all these complicated rules, I decided to make it a bit explicit and the people with the simple case (like, say, me) can just use a trivial script like that.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net