MFA attribute for CAS serviceValidate

[Cantor, Scott]

On 4/12/17, 3:20 PM, "users on behalf of Marvin Addison" <users-bounces at shibboleth.net on behalf of marvin.addison at gmail.com> wrote:

> We have a scripted attribute definition that examines all the AuthnContextClassRefPrincipals attached to _any_ subject found in
> the IdP session, which is how we support conveying an LOA value to CAS clients over back channel communication. Here's a gist
> you may find helpful:

I couldn't shake the feeling that I thought Rod had added something to the resolver for this release that was supposed to ease the process of doing something with the Subject, apart from just the addition of the subjects array to the scripts. That alone would simplify a bit of your script there.

I think what I was thinking of is a thing called SubjectDerivedAttributeValuesFunction, which is an impl class. I think what it does is facilitate pulling attribute values out of the Subject. I don't know if it's documented or not.

Anyway, it occurred to me that one thing you could do that might be of some kind of simplifying value would be to define an IdPAttributePrincipal statically as a supportedPrincipal for a login flow, and actually pull out and clone that IdPAttribute's values directly in a script. I'd have to play around with that idea I guess, I'm not sure if it makes any sense or helps at all.

Rod probably remembers better what this class was targeted at.

-- Scott