Intercept flows and adjustable auth levels

[Rich Graves]

Disclaimer: I really have no idea what I'm talking about, but it seems I
might be a half-step ahead of you.

Christopher Bongaarts:
> Is there some way to pick up a flow where it left off?

Look at attribute release/consent for inspiration. A simpler example that
comes very close to both of your expressed needs is IDP-913, which is not
hard to backport to 3.2.1 -- even I did it!

https://issues.shibboleth.net/jira/browse/IDP-913
http://svn.shibboleth.net/view/java-identity-provider?view=revision&revision=8085
Since you can do this, your other more intrusive questions about the auth
process don't really need to be answered. I'd be happy to share code online
or even in person, since we're neighbors.

> Perhaps as information in a dynamic link to our pw/secrets app (so it has
a URL to return the user to when finished)?  Maybe Spring has some magic
that allows this?

$flowExecutionUrl&_eventId_proceed=1 is the way back to the shibb session,
but you still need to authenticate from shibb to your external app.

The "best" way to do this is probably to use the CAS support in shibb.
Since I'm unequipped to do it the best way, I am looking to accomplish the
handoff by putting Jetty behind Apache, running some stub scripts at the
Apache layer, and communicating between the two layers with browser
cookies. It is possible to both set and read cookies entirely with scripted
attributes. Then you can use those attributes as activation conditions for
minor variations on Context Check and Expiring Password flows. Something
like:

    <resolver:AttributeDefinition id="carlVerifiedCookie"
xsi:type="ad:Script"

customObjectRef="shibboleth.HttpServletRequest" />>
        <ad:Script><![CDATA[
            logger =
Java.type("org.slf4j.LoggerFactory").getLogger("net.shibboleth.idp.attribute");
            for (i = 0; i < custom.getCookies().length; i++) {
                cookie = custom.getCookies()[i];
                if (cookie.getName() == "carl_verified") {
                    clientCookies.addValue(cookie.getValue());
            }
            logger.info("Created clientCookies attribute as {}",
clientCookies.getValues());
    ]]></ad:Script>
    </resolver:AttributeDefinition>

 // PoC. In reality I am considering setting the cookie to something like
rot13(username) + time + hmac(key, username + timestamp + browser)
    <resolver:AttributeDefinition id="setClientCookie" xsi:type="ad:Script"

customObjectRef="shibboleth.HttpServletResponse"

p:activationCondition-ref="carl.carlIsVerifiedCondition">
        <ad:Script><![CDATA[
            logger =
Java.type("org.slf4j.LoggerFactory").getLogger("net.shibboleth.idp.attribute");
            uuidgen = Java.type("java.util.UUID");
            uuid = uuidgen.randomUUID();
            CookieClass = Java.type('javax.servlet.http.Cookie');
            cookie = new CookieClass("carl_verified",uuid.toString());
            cookie.setSecure(true);
            cookie.setMaxAge(8640000);
            cookie.setPath('/');
            custom.addCookie(cookie);
    ]]></ad:Script>
    </resolver:AttributeDefinition>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160628/8420c80d/attachment.html>