Use group for MFA

[Andrew Morgan]

On Wed, 5 Apr 2017, Richard Frovarp wrote:

> On 04/05/2017 03:41 PM, Andrew Morgan wrote:
>> On Wed, 5 Apr 2017, Richard Frovarp wrote:
>> 
>>> I'm trying to figure out how to trigger MFA in Shib 3.3 using the built in 
>>> Duo integration based off of group membership in AD.
>>> 
>>> I have figured out how to get the MFA workflow to work, and how to write 
>>> the most simplistic code to either just go with password or to push on 
>>> with Duo. What I haven't figured out how to do is get user attributes. I'm 
>>> resolving attributes out of AD, and I'm hoping that takes place after 
>>> password, and is somehow available at the MFA checkSecondFactor spot. Is 
>>> it in the SubjectContext, and is that available via the getSubcontext() 
>>> calls? Is there something else I need to be looking at? From the javadocs, 
>>> it isn't entirely clear as to what I should be looking at.
>> 
>> It's not too bad.  Here is my MFA flow script:
>> 
>> 
>> <AttributeDefinition id="needs_duo" xsi:type="ScriptedAttribute">
>>     <Dependency ref="myLDAP" />
>>     <Script><![CDATA[
>>         logger = 
>> Java.type("org.slf4j.LoggerFactory").getLogger("net.shibboleth.idp.attribute.resolver.needs_duo");
>>         duoflag = "0";
>>         for (i=0; i < ismemberof.getValues().size() - 1; i++) {
>> 
>
> Looks like an off by one there.

Good catch!  I tried many different approaches during testing, and some of 
the weirder stuff must have been left in there.  I removed the "- 1" and 
verified the correct operation.

Thanks,
 	Andy