Advice on migrating SPNEGO to MFA-flow

[Philip Brusten]

Hi,

I would like some advice on how we must migrate from our current 
authentication setup towards the MFA-flow.
Our current setup is based on the MCB-model 
(https://wiki.shibboleth.net/confluence/display/IDP30/Configuring+the+IdP+for+the+Multi-Context+Broker+Model) 
and uses SPNEGO or Password as initial authentication. SPNEGO has an 
activationCondition based on some subnets and SPNEGO is triggered by the 
cookie  '_idp_spnego_autologin'.

idp.authn.flows = SPNEGO|Password|multifactor
idp.authn.flows.initial = SPNEGO|Password
idp.authn.resolveAttribute = eduPersonAssurance

I got the MFA-flow working for Password + multifactor, but now I'm stuck 
adding SPNEGO to that flow. In the nextFlowStrategy "checkSecondFactor" 
I check if the SubjectCanonicalizationContext is not set in the 
assumption that SPNEGO did not succeed (e.g. activationCondition for 
SPNEGO was not met or user did not have cookie '_idp_spnego_autologin'). 
But SPNEGO returns a ReselectFlow event, which cannot be catched by the 
MFA-flow, so the MFA-flow exits. Since SPNEGO is a system flow, changing 
it's default behaviour doesn't seem like an option.

This is my config:
idp.authn.flows = MFA
#idp.authn.flows.initial = SPNEGO|Password
#idp.authn.resolveAttribute = eduPersonAssurance

TransitionMap:

     <util:map id="shibboleth.authn.MFA.TransitionMap">
         <entry key="">
             <bean parent="shibboleth.authn.MFA.Transition" p:nextFlow="authn/SPNEGO" />
         </entry>
         <entry key="authn/SPNEGO">
             <bean parent="shibboleth.authn.MFA.Transition" p:nextFlowStrategy-ref="checkSecondFactor" />
         </entry>
         
         <entry key="authn/Password">
             <bean parent="shibboleth.authn.MFA.Transition" p:nextFlowStrategy-ref="checkSecondFactor" />
         </entry>
         <!-- An implicit final rule will return whatever the final flow returns. -->
     </util:map>
  
     <bean id="checkSecondFactor" parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript" p:customObject-ref="shibboleth.AttributeResolverService">
         <constructor-arg>
             <value>
             <![CDATA[
                 nextFlow = 'authn/multifactor';
                 // Go straight to second factor if we have to, or set up for an attribute lookup first.
                 authCtx = input.getSubcontext("net.shibboleth.idp.authn.context.AuthenticationContext");
                 mfaCtx = authCtx.getSubcontext("net.shibboleth.idp.authn.context.MultiFactorAuthenticationContext");
                 subjCtx = input.getSubcontext("net.shibboleth.idp.authn.context.SubjectCanonicalizationContext");
                 if (subjCtx == null) {
                    //Assume SPNEGO authn did not succeed
                    nextFlow = 'authn/Password'
			
                 //check is the current MFA-conftext is already acceptable, if so check if the user did an opt-in, otherwise finish (with value 'null')
                 } else if (subjCtx != null && mfaCtx.isAcceptable()) {
                     // Attribute check is required to decide if first factor alone is enough.
                     resCtx = input.getSubcontext(
                         "net.shibboleth.idp.attribute.resolver.context.AttributeResolutionContext", true);
                     resCtx.setPrincipal(subjCtx.getPrincipalName());
                     resCtx.getRequestedIdPAttributeNames().add("eduPersonAssurance");
                     resCtx.resolveAttributes(custom);
                     // Check for an attribute that authorizes use of first factor.
                     attribute = resCtx.getResolvedIdPAttributes().get("eduPersonAssurance");
                     valueType =  Java.type("net.shibboleth.idp.attribute.StringAttributeValue");
                     if (attribute == null || (attribute != null && ! attribute.getValues().contains(new valueType("https://example.com/auth/multifactor")))) {
                         nextFlow = null;
                     }
                     input.removeSubcontext(resCtx);   // cleanup
                 }
                 nextFlow;   // pass control to second factor or end with the first
             ]]>
             </value>
         </constructor-arg>
     </bean>


Relevant logs:
2016-12-14 09:35:56,403 - DEBUG 
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:338] - 
[192.168.0.10]|Profile Action SelectAuthenticationFlow: Selecting 
inactive authentication flow authn/MFA
2016-12-14 09:35:56,588 - DEBUG 
[net.shibboleth.idp.authn.impl.PopulateMultiFactorAuthenticationContext:164] 
- [192.168.0.10]|Profile Action 
PopulateMultiFactorAuthenticationContext: 0 active result(s) extracted 
for possible reuse
2016-12-14 09:35:56,602 - DEBUG 
[net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:195] 
- [192.168.0.10]|Profile Action TransitionMultiFactorAuthentication: 
Applying MFA transition rule to determine initial state
2016-12-14 09:35:56,602 - DEBUG 
[net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:214] 
- [192.168.0.10]|Profile Action TransitionMultiFactorAuthentication: MFA 
flow transition after 'proceed' event to 'authn/SPNEGO' flow
2016-12-14 09:35:56,792 - DEBUG 
[net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:197] 
- [192.168.0.10]|Profile Action TransitionMultiFactorAuthentication: 
Applying MFA transition rule to exit state 'authn/SPNEGO'
2016-12-14 09:35:56,792 - DEBUG 
[net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:219] 
- [192.168.0.10]|Profile Action TransitionMultiFactorAuthentication: MFA 
flow completing with event 'ReselectFlow'
2016-12-14 09:35:56,800 - INFO 
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:129] - 
[192.168.0.10]|Profile Action SelectAuthenticationFlow: Moving 
incomplete flow authn/MFA to intermediate set
2016-12-14 09:35:56,800 - DEBUG 
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:255] - 
[192.168.0.10]|Profile Action SelectAuthenticationFlow: No specific 
Principals requested
2016-12-14 09:35:56,800 - DEBUG 
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:290] - 
[192.168.0.10]|Profile Action SelectAuthenticationFlow: No usable active 
results available, selecting an inactive flow
2016-12-14 09:35:56,801 - INFO 
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:294] - 
[192.168.0.10]|Profile Action SelectAuthenticationFlow: No potential 
flows left to choose from, authentication failed

Kind regards,

Philip