Displaying a simple error page from a flow

[Wessel, Keith]

Thanks, Scott. That's what I suspected.

A problem with this solution: I don't think I can have two p:customObject-ref values. The shibboleth.AttributeResolverService is already there. When I try adding a customObject-ref to the new bean that I added to my file, I get a schema error saying that customObject-ref is already defined. Is there a way to have two?

Keith


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Thursday, December 08, 2016 6:12 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: Displaying a simple error page from a flow

On 12/8/16, 5:29 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:

>    Just to follow up to the list, the shortcut didn't work. It ignored the extra code and terminated the flow with a proceed
> event, passing me through with password authentication. The more complex route worked, though.

Alright, I'd welcome a ticket on that, we need a cleaner way of handling that, probably just something added to the context tree explicitly as a signal.

> The getPrincipal call is exactly taken from the sample function shipped with the IdP and comes right after initializing the
> variable to the AttributeResolverContext subcontext, of course.
    
The example's not right, it won't work if the first factor didn't happen right then. Didn't test enough.

The function to compute the name that's actually in the Duo flow looks like this:

            final SubjectCanonicalizationContext c14nContext =
                    input.getSubcontext(SubjectCanonicalizationContext.class);
            if (c14nContext != null && c14nContext.getPrincipalName() != null) {
                return c14nContext.getPrincipalName();
            }
            
            final SessionContext sessionContext = input.getSubcontext(SessionContext.class);
            if (sessionContext != null && sessionContext.getIdPSession() != null) {
                return sessionContext.getIdPSession().getPrincipalName();
            }

The null checking plus the second part is missing from the example, and since all that's wrapped up in a Function class anyway, I would just have pulled an instance of that class in:

    <bean id="UsernameLookupStrategy"
        class="net.shibboleth.idp.session.context.navigate.CanonicalUsernameLookupStrategy" />

Stuff that into the script via customObject and you can just run it to get the name out. *That* is guaranteed to work since if Password succeeds, either it ran just then or SSO happened and the session has the identity.

File a bug and I'll fix up the example.

-- Scott


-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net