MFA attribute for CAS serviceValidate

[Cantor, Scott]

On 4/12/17, 1:34 PM, "users on behalf of John C. Pfeifer" <users-bounces at shibboleth.net on behalf of pfeifer at umd.edu> wrote:

> In my current CAS server, I release an attribute value in the serviceValidate response which indicates if the user had done Duo at
> some point in the current SSO session.  I figure that I will need to script something in either the attribute resolver or filter but am
> unclear on how to detect if MFA had happened.

Authentication type is a function of the Principals inside the Subject(s) (standard Java security classes), either something technical in nature (there's a DuoPrincipal produced as a placeholder) or one of the AuthnContextClassRefPrincipals which are determined by you/your settings.

Scripts in the resolver have a "subjects" variable containing the array of Subjects produced by all the factors.

This assumes front-channel. There is no way to do this on the back channel, not in any supported way.

-- Scott