Forcing Duo by Service Provider

[Brandon McKean]

I was able to integrate that snippet into the original 
mfa-authn-config.xml bit I had too achieve what I was going for:

> <bean id="checkSecondFactor" 
> parent="shibboleth.ContextFunctions.Scripted" 
> factory-method="inlineScript">
>         <constructor-arg>
>             <value>
>             <![CDATA[
>                 nextFlow = "authn/Duo";
>                 authCtx = 
> input.getSubcontext("net.shibboleth.idp.authn.context.AuthenticationContext");
>                 mfaCtx = 
> authCtx.getSubcontext("net.shibboleth.idp.authn.context.MultiFactorAuthenticationContext");
>                    if (mfaCtx.isAcceptable()) {
>                         nextFlow=null;
> }
>                 value = 
> profileContext.getSubcontext("net.shibboleth.idp.profile.context.RelyingPartyContext").getRelyingPartyId();
>                 if (value == 'entityIDhere')
>                 {
>                         nextFlow = "authn/Duo";
>                 }
>                 nextFlow;  // pass control to second factor or end 
> with the first
>             ]]>
>             </value>
>         </constructor-arg>
>     </bean> 
I know it isn't the way it's supposed to be done, but it's simple and 
works for our use case.

-- 
Brandon McKean
IT / Systems
Linux Administrator
(540)568-4235

On 03/31/2017 06:08 PM, Michael A Grady wrote:
>
>> On Mar 31, 2017, at 5:03 PM, Andrew Morgan <morgan at orst.edu 
>> <mailto:morgan at orst.edu>> wrote:
>>
>> Do I get it from Michael's code snippet:
>>
>> profileContext.getSubcontext("net.shibboleth.idp.profile.context.RelyingPartyContext").getRelyingPartyId();
>
> Just to give credit where credit is due, Josh O'Dowd had provided that 
> back in mid-February. :-)
>
> --
> Michael A. Grady
> IAM Architect, Unicon, Inc.
>
>
>
>
>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170405/be194f06/attachment.html>