Use group for MFA

[Richard Frovarp]

On 04/05/2017 03:41 PM, Andrew Morgan wrote:
> On Wed, 5 Apr 2017, Richard Frovarp wrote:
>
>> I'm trying to figure out how to trigger MFA in Shib 3.3 using the 
>> built in Duo integration based off of group membership in AD.
>>
>> I have figured out how to get the MFA workflow to work, and how to 
>> write the most simplistic code to either just go with password or to 
>> push on with Duo. What I haven't figured out how to do is get user 
>> attributes. I'm resolving attributes out of AD, and I'm hoping that 
>> takes place after password, and is somehow available at the MFA 
>> checkSecondFactor spot. Is it in the SubjectContext, and is that 
>> available via the getSubcontext() calls? Is there something else I 
>> need to be looking at? From the javadocs, it isn't entirely clear as 
>> to what I should be looking at.
>
> It's not too bad.  Here is my MFA flow script:
>
>
> <AttributeDefinition id="needs_duo" xsi:type="ScriptedAttribute">
>     <Dependency ref="myLDAP" />
>     <Script><![CDATA[
>         logger = 
> Java.type("org.slf4j.LoggerFactory").getLogger("net.shibboleth.idp.attribute.resolver.needs_duo");
>         duoflag = "0";
>         for (i=0; i < ismemberof.getValues().size() - 1; i++) {
>

Looks like an off by one there.

>
> This example might be useful if you want to enable Duo for specific 
> users for a specific relying party.  Watch out for gaps with step-up 
> MFA though!
>
> However, if you want to force Duo for a particular relying party, it's 
> better to do it in relying-party.xml.
>
> I hope this helps.
>
>     Andy


That example helped tremendously. Thank you very much. With slight 
adaptation I was able to make it work exactly how I wanted it to go.