IDP 3.3 MFA flow - how to get the SP EntityID on the scripted checkSecondFactor ?

[Wessel, Keith]

I'll add that Scott's suggestion makes dynamically adding new SPs that require MFA or non-MFA overrides way easier as you can just reload the RelyingPartyResolverService. You can even key off of metadata entity attributes, if you control the metadata or are tagging it on IdP load, to determine who needs MFA. Long run, it's way better than hard coding SP entityIDs into your MFA script.

See Scott and my thread from yesterday for details.

Keith


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Wednesday, December 14, 2016 5:01 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: IDP 3.3 MFA flow - how to get the SP EntityID on the scripted checkSecondFactor ?

On 12/14/16, 5:56 PM, "users on behalf of Leite, Zailo S." <users-bounces at shibboleth.net on behalf of zleite at caltech.edu> wrote:

>    I need to compare on the value. Suggestions?

The same way it's shown in examples all over the distribution, documentation, and dozens of past list messages, RelyingPartyContext child context, getRelyingPartyId method.

You should not do this in general. Use the defaultAuthenticationMethod setting for that relying party to control what is acceptable.

-- Scott


-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net