Can I access AuthnContextClassRef in a flow decision state?

Jim Fox fox at washington.edu
Wed Jun 15 19:02:30 EDT 2016 

>> When a request
>> arrives asking for AuthnContextClassRef=TimeSyncToken this flow still gets run.
>
> That shouldn't happen. It should check for that and prevent it from running.
>

Summary of config and log below.

Jim



This in idp.properties

   # RemoteUserInternal handles ECP only
   idp.authn.flows= remoteuserplus|remoteusertoken|RemoteUserInternal


This in general-authn.xml

-------------------------------------------------------------
         <!-- external with passive/force support -->
         <bean id="authn/remoteuserplus" parent="shibboleth.AuthenticationFlow"
                p:passiveAuthenticationSupported="true"
                p:forcedAuthenticationSupported="true"
                p:nonBrowserSupported="false">
             <property name="supportedPrincipals">
                 <util:list>
                     <bean parent="shibboleth.SAML2AuthnContextClassRef"
                         c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" />
                     <bean parent="shibboleth.SAML2AuthnContextClassRef"
                         c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:Password" />
                     <bean parent="shibboleth.SAML2AuthnContextClassRef"
                         c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified" />
                 </util:list>
             </property>
         </bean>

         <!-- external with token support -->
         <bean id="authn/remoteusertoken" parent="shibboleth.AuthenticationFlow"
                p:forcedAuthenticationSupported="true"
                p:nonBrowserSupported="false">
             <property name="supportedPrincipals">
                 <util:list>
                     <bean parent="shibboleth.SAML2AuthnContextClassRef"
                         c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken" />
                 </util:list>
             </property>
         </bean>
-----------------------------------------------------------------

A request arrives with:

     <samlp:RequestedAuthnContext>
         <saml:AuthnContextClassRef xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken</saml:AuthnContextClassRef>
     </samlp:RequestedAuthnContext>


This is the process log (in three segments, starting at initializing the AuthenticationContext)

---------------------------------------------------------------------
2016-06-15 15:25:29,863 - DEBUG [net.shibboleth.idp.saml.profile.impl.InitializeAuthenticationContext:115] - Profile Action InitializeAuthenticationContext: Created authentication context: AuthenticationContext{initiationInstant=2016-06-15T15:25:29.863-07:00, isPassive=false, forceAuthn=false, hintedName=null, potentialFlows=[], activeResults=[], attemptedFlow=null, signaledFlowId=null, authenticationStateMap={}, resultCacheable=true, initialAuthenticationResult=null, authenticationResult=null, completionInstant=1969-12-31T16:00:00.000-08:00}
2016-06-15 15:25:29,866 - DEBUG [net.shibboleth.idp.session.impl.PopulateSessionContext:131] - Profile Action PopulateSessionContext: No session found for client
2016-06-15 15:25:29,868 - DEBUG [net.shibboleth.idp.authn.impl.PopulateAuthenticationContext:126] - Profile Action PopulateAuthenticationContext: Installing custom PrincipalEvalPredicateFactoryRegistry into AuthenticationContext
2016-06-15 15:25:29,872 - DEBUG [net.shibboleth.idp.authn.impl.PopulateAuthenticationContext:167] - Profile Action PopulateAuthenticationContext: Installed 3 authentication flows into AuthenticationContext
2016-06-15 15:25:29,873 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByForcedAuthn:53] - Profile Action FilterFlowsByForcedAuthn: Request does not have forced authentication requirement, nothing to do
2016-06-15 15:25:29,873 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByPassivity:53] - Profile Action FilterFlowsByPassivity: Request does not have passive requirement, nothing to do
2016-06-15 15:25:29,874 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByNonBrowserSupport:53] - Profile Action FilterFlowsByNonBrowserSupport: Request does not have non-browser requirement, nothing to do
2016-06-15 15:25:29,874 - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:257] - Profile Action SelectAuthenticationFlow: No specific Principals requested
2016-06-15 15:25:29,875 - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:292] - Profile Action SelectAuthenticationFlow: No usable active results available, selecting an inactive flow
2016-06-15 15:25:29,875 - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:334] - Profile Action SelectAuthenticationFlow: Selecting inactive authentication flow authn/remoteuserplus
---------------------------------------------------------------------

It has not yet noticed the Token request, and selects remoteuserplus
Here I get asked for id and password by the external login process

---------------------------------------------------------------------
2016-06-15 15:25:40,463 - DEBUG [net.shibboleth.idp.authn.impl.RemoteUserAuthServlet:231] - User identity extracted from REMOTE_USER: fox
2016-06-15 15:25:40,474 - INFO [net.shibboleth.idp.authn.impl.ValidateExternalAuthentication:115] - Profile Action ValidateExternalAuthentication: External authentication succeeded for user: fox
2016-06-15 15:25:40,476 - DEBUG [net.shibboleth.idp.authn.AbstractValidationAction:311] - Profile Action ValidateExternalAuthentication: Adding custom Principal(s) defined on underlying flow descriptor
2016-06-15 15:25:40,477 - DEBUG [net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext:79] - Profile Action PopulateSubjectCanonicalizationContext: Installing 2 canonicalization flows into SubjectCanonicalizationContext
2016-06-15 15:25:40,479 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] - Profile Action SelectSubjectCanonicalizationFlow: Checking canonicalization flow c14n/x500 for applicability...
2016-06-15 15:25:40,480 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:106] - Profile Action SelectSubjectCanonicalizationFlow: Canonicalization flow c14n/x500 was not applicable to this request
2016-06-15 15:25:40,481 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] - Profile Action SelectSubjectCanonicalizationFlow: Checking canonicalization flow c14n/simple for applicability...
2016-06-15 15:25:40,481 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:83] - Profile Action SelectSubjectCanonicalizationFlow: Selecting canonicalization flow c14n/simple
2016-06-15 15:25:40,482 - DEBUG [net.shibboleth.idp.authn.AbstractSubjectCanonicalizationAction:226] - Profile Action SimpleSubjectCanonicalization: trimming whitespace of input string 'fox'
2016-06-15 15:25:40,484 - DEBUG [net.shibboleth.idp.authn.impl.FinalizeAuthentication:137] - Profile Action FinalizeAuthentication: Canonical principal name was established as 'fox'
2016-06-15 15:25:40,487 - DEBUG [net.shibboleth.idp.authn.impl.FinalizeAuthentication:186] - Profile Action FinalizeAuthentication: Request did not have explicit authentication requirements, result is accepted
2016-06-15 15:25:40,488 - DEBUG [net.shibboleth.idp.session.impl.UpdateSessionWithAuthenticationResult:221] - Profile Action UpdateSessionWithAuthenticationResult: Creating new session for principal fox
2016-06-15 15:25:40,489 - DEBUG [net.shibboleth.idp.session.impl.StorageBackedSessionManager:533] - Created new session d2c53db78f86a5800352f8599457ce869ec987ed35d8e35e1a8dc0efd7a3875a for principal fox
2016-06-15 15:25:40,490 - DEBUG [net.shibboleth.idp.session.impl.StorageBackedIdPSession:561] - Saving AuthenticationResult for flow authn/remoteuserplus in session d2c53db78f86a5800352f8599457ce869ec987ed35d8e35e1a8dc0efd7a3875a
2016-06-15 15:25:40,493 - DEBUG [net.shibboleth.idp.saml.profile.impl.InitializeAuthenticationContext:115] - Profile Action InitializeAuthenticationContext: Created authentication context: AuthenticationContext{initiationInstant=2016-06-15T15:25:40.493-07:00, isPassive=false, forceAuthn=false, hintedName=null, potentialFlows=[], activeResults=[], attemptedFlow=null, signaledFlowId=null, authenticationStateMap={}, resultCacheable=true, initialAuthenticationResult=AuthenticationResult{authenticationFlowId=authn/remoteuserplus, authenticatedPrincipal=fox, authenticationInstant=2016-06-15T15:25:40.476-07:00, lastActivityInstant=2016-06-15T15:25:40.476-07:00}, authenticationResult=null, completionInstant=1969-12-31T16:00:00.000-08:00}
2016-06-15 15:25:40,494 - DEBUG [net.shibboleth.idp.authn.impl.InitializeRequestedPrincipalContext:111] - Profile Action InitializeRequestedPrincipalContext: Profile configuration does not include any default authentication methods
2016-06-15 15:25:40,495 - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.ProcessRequestedAuthnContext:188] - Profile Action ProcessRequestedAuthnContext: RequestedPrincipalContext created with operator exact and 1 custom principal(s)
2016-06-15 15:25:40,502 - DEBUG [net.shibboleth.idp.authn.impl.PopulateAuthenticationContext:126] - Profile Action PopulateAuthenticationContext: Installing custom PrincipalEvalPredicateFactoryRegistry into AuthenticationContext
2016-06-15 15:25:40,504 - DEBUG [net.shibboleth.idp.authn.impl.PopulateAuthenticationContext:167] - Profile Action PopulateAuthenticationContext: Installed 3 authentication flows into AuthenticationContext
2016-06-15 15:25:40,506 - DEBUG [net.shibboleth.idp.session.impl.PopulateSessionContext:131] - Profile Action PopulateSessionContext: No session found for client
2016-06-15 15:25:40,507 - DEBUG [net.shibboleth.idp.session.impl.ExtractActiveAuthenticationResults:112] - Profile Action ExtractActiveAuthenticationResults: authentication result authn/remoteuserplus is active, copying from session
2016-06-15 15:25:40,514 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByForcedAuthn:53] - Profile Action FilterFlowsByForcedAuthn: Request does not have forced authentication requirement, nothing to do
2016-06-15 15:25:40,515 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByPassivity:53] - Profile Action FilterFlowsByPassivity: Request does not have passive requirement, nothing to do
2016-06-15 15:25:40,516 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByNonBrowserSupport:53] - Profile Action FilterFlowsByNonBrowserSupport: Request does not have non-browser requirement, nothing to do
2016-06-15 15:25:40,517 - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:366] - Profile Action SelectAuthenticationFlow: Specific principals requested with 'exact' operator: [AuthnContextClassRefPrincipal{authnContextClassRef=urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken}]
2016-06-15 15:25:40,517 - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:477] - Profile Action SelectAuthenticationFlow: Checking for an inactive flow or active result compatible with operator 'exact' and principal 'urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken'
2016-06-15 15:25:40,519 - DEBUG [net.shibboleth.idp.authn.principal.PrincipalEvalPredicateFactoryRegistry:80] - Registry located predicate factory of type 'net.shibboleth.idp.authn.principal.impl.ExactPrincipalEvalPredicateFactory' for principal type 'class net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal' and operator 'exact'
2016-06-15 15:25:40,520 - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:334] - Profile Action SelectAuthenticationFlow: Selecting inactive authentication flow authn/remoteusertoken
-----------------------------------------------------------

It has see the token request and activates remoteusertoken
Here I get asked for a token by the external login process.

------------------------------------------------------------
2016-06-15 15:25:56,808 - DEBUG [net.shibboleth.idp.authn.impl.RemoteUserAuthServlet:231] - User identity extracted from REMOTE_USER: fox
2016-06-15 15:25:56,829 - INFO [net.shibboleth.idp.authn.impl.ValidateExternalAuthentication:115] - Profile Action ValidateExternalAuthentication: External authentication succeeded for user: fox
2016-06-15 15:25:56,830 - DEBUG [net.shibboleth.idp.authn.AbstractValidationAction:311] - Profile Action ValidateExternalAuthentication: Adding custom Principal(s) defined on underlying flow descriptor
2016-06-15 15:25:56,831 - DEBUG [net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext:79] - Profile Action PopulateSubjectCanonicalizationContext: Installing 2 canonicalization flows into SubjectCanonicalizationContext
2016-06-15 15:25:56,831 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] - Profile Action SelectSubjectCanonicalizationFlow: Checking canonicalization flow c14n/x500 for applicability...
2016-06-15 15:25:56,832 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:106] - Profile Action SelectSubjectCanonicalizationFlow: Canonicalization flow c14n/x500 was not applicable to this request
2016-06-15 15:25:56,833 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] - Profile Action SelectSubjectCanonicalizationFlow: Checking canonicalization flow c14n/simple for applicability...
2016-06-15 15:25:56,833 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:83] - Profile Action SelectSubjectCanonicalizationFlow: Selecting canonicalization flow c14n/simple
2016-06-15 15:25:56,838 - DEBUG [net.shibboleth.idp.authn.AbstractSubjectCanonicalizationAction:226] - Profile Action SimpleSubjectCanonicalization: trimming whitespace of input string 'fox'
2016-06-15 15:25:56,847 - DEBUG [net.shibboleth.idp.session.impl.DetectIdentitySwitch:168] - {} Identities from session and new authentication result match, nothing to do
2016-06-15 15:25:56,848 - DEBUG [net.shibboleth.idp.authn.impl.FinalizeAuthentication:137] - Profile Action FinalizeAuthentication: Canonical principal name was established as 'fox'
2016-06-15 15:25:56,852 - DEBUG [net.shibboleth.idp.authn.impl.FinalizeAuthentication:242] - Profile Action FinalizeAuthentication: Checking result for compatibility with operator 'exact' and principal 'urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken'
2016-06-15 15:25:56,853 - DEBUG [net.shibboleth.idp.authn.principal.PrincipalEvalPredicateFactoryRegistry:80] - Registry located predicate factory of type 'net.shibboleth.idp.authn.principal.impl.ExactPrincipalEvalPredicateFactory' for principal type 'class net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal' and operator 'exact'
2016-06-15 15:25:56,854 - DEBUG [net.shibboleth.idp.authn.impl.FinalizeAuthentication:262] - Profile Action FinalizeAuthentication: Principal 'urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken' in authentication result satisfies request for principal 'urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken'
2016-06-15 15:25:56,855 - DEBUG [net.shibboleth.idp.session.impl.UpdateSessionWithAuthenticationResult:200] - Profile Action UpdateSessionWithAuthenticationResult: Adding new AuthenticationResult for flow authn/remoteusertoken to existing session d2c53db78f86a5800352f8599457ce869ec987ed35d8e35e1a8dc0efd7a3875a
----------------------------------------------------

Token authn completed

More information about the users mailing list