IDP 3.3 MFA flow -- working example

[Joe Edwards]

On Mon, 12 Dec 2016, Cantor, Scott wrote:
>> Then, we used the same logic used in that flow to include
>> optional RSA and yubikey 2 factor authentication,
>> based on user based or SP criteria.
>> The RSA flow includes handling of NEW_PIN_REQUIRED
>> and NEXT_CODE_REQUIRED.
> .....snip
>
> I'd be a little curious how you managed that RSA part,
> I never saw any way to handle those modes with the Java SDK
> from RSA. It looked like it would take holding connections to
> SecurID open across web requests, which is a non-starter to me.

After password authentication....

We use a com.rsa.authagent.authapi.AuthSession.

<evaluate 
expression="our.package.shibboleth.auth.rsaSession.getRsaSession()" 
result="flowScope.rsaAuthSession" />

The rsa session is then passed to our rsaAuth class:
  //check the passcode entered
  authStatus = session.check(userId, passcode);

which deals with the result:
  switch (authStatus) {
   case AuthSession.ACCESS_OK:
   case AuthSession.NEW_PIN_REQUIRED:
   case AuthSession.NEXT_CODE_REQUIRED:

the user sees the appropriate page:
  <transition on="ACCESS_OK" to="cleanup" />
  <transition on="ERROR"     to="RsaErrTwoFactorPage" />
  <transition on="NEW_PIN"   to="RsaNewPinPage" />
  <transition on="NEXT_CODE" to="RsaNextTokenPage" />

The rsa session enables the user to submit the NEXT_CODE.

  authStatus = session.next(nextcode);
   case AuthSession.ACCESS_OK
   case AuthSession.ACCESS_DENIED
   case AuthSession.NEXT_CODE_BAD

- Joe