Advice on migrating SPNEGO to MFA-flow

[Cantor, Scott]

On 12/14/16, 4:50 AM, "users on behalf of Philip Brusten" <users-bounces at shibboleth.net on behalf of philip.brusten at kuleuven.be> wrote:

> and uses SPNEGO or Password as initial authentication. SPNEGO has an 
>    activationCondition based on some subnets and SPNEGO is triggered by the 
>    cookie  '_idp_spnego_autologin'.

SPNEGO is was designed to fit together with the Password flow and the cookie stuff that SWITCH built, so it really may have to be driven by that more than the MFA logic, it depends on the use case.

Also, any use of initial-authn is broken. It will not be included in 4.0 barring me totally changing my mind about it. If you need to control the order of flows, use the MFA flow for that.

> I got the MFA-flow working for Password + multifactor, but now I'm stuck 
> adding SPNEGO to that flow. In the nextFlowStrategy "checkSecondFactor" 

You don't have to follow the example, you can build any transitions you want/need.

> I check if the SubjectCanonicalizationContext is not set in the 
> assumption that SPNEGO did not succeed (e.g. activationCondition for 
> SPNEGO was not met or user did not have cookie '_idp_spnego_autologin'). 

If you want to know if some method was performed, you need to do that by examining the results available for the subject, not using logic like that. Typically you should rely on custom Principals for that and test for their presence in the results or use the isAcceptable hook to see if the overall set of results satisfies some requirement for authentication in a particular way.

>    But SPNEGO returns a ReselectFlow event, which cannot be catched by the 
>    MFA-flow, so the MFA-flow exits. Since SPNEGO is a system flow, changing 
>    it's default behaviour doesn't seem like an option.

I don't believe it cannot be caught. You didn't supply a transition rule for ReslectFlow so it fell through as the final result of the MFA flow. If you want to handle it, you need to handle it, and provide a rule for that event. If the docs aren't clear on how to do that, let me know.

I could be wrong, it's possible ReselectFlow is being handled in a way that prevents that, but I don't think so, and your rules don't mention it.

So:

- stop using initial-authn
- you should not be looking at the SubjectCanonicalizationContext, certainly not as a means of determining anything about how authentication happens
- you need to handle whatever events you want to handle in the transition rules you supply for exiting particular flows

Beyond that, I would have to have a better explanation of exactly what behaviour you're trying to support. The only obvious solution is "use AuthnContext principals to select the methods you want to run by triggering them from the SP or via defaultAuthenticationMethods". As soon as you start adding special cases, attribute checks, cookies, weird exceptions, etc., all of that becomes impossible to advise on unless the rules are spelled out in a way I can follow.

-- Scott