Impersonation in IDP

[Hong Ye]

Hello,

We have a need to implement impersonation is IDP. We are using MFA flow and the primary authentication is RemoteUser. I’m wondering if it is possible to switch user identity in mfa-authn-config.xml
after user finish DUO. I tired modifying mfa-authn-config.xml without success.

With the code below, I got warning

2017-08-21 10:18:27,025| - WARN [net.shibboleth.idp.authn.impl.FinalizeAuthentication:203] - Profile Action FinalizeAuthentication: Result of authentication (hy93) does not match existing subject in context (foo)
2017-08-21 10:18:27,044| - WARN [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event occurred while processing the request: InvalidSubjectContext

mfa-authn-config.xml
    <util:map id="shibboleth.authn.MFA.TransitionMap">
        <entry key="">
          <bean parent="shibboleth.authn.MFA.Transition" p:nextFlow="authn/RemoteUser" />
        </entry>

        <!--
        Second rule runs a function if RemoteUser succeeds, to determine whether an additional
        factor is required.
        -->
        <entry key="authn/RemoteUser">
            <bean parent="shibboleth.authn.MFA.Transition" p:nextFlowStrategy-ref="checkSecondFactor" />
        </entry>

         <entry key="authn/Duo">
            <bean parent="shibboleth.authn.MFA.Transition" p:nextFlowStrategy-ref="checkImpersonation" />
        </entry>

        <!-- An implicit final rule will return whatever the final flow returns. -->
    </util:map>

    <bean id="checkImpersonation " parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript"
        p:customObject-ref="shibboleth.AttributeResolverService">
        <constructor-arg>
            <value>
            <![CDATA[
                nextFlow = null;

                // Go straight to second factor if we have to, or set up for an attribute lookup first.
                authCtx = input.getSubcontext("net.shibboleth.idp.authn.context.AuthenticationContext");
                c14nCtx = input.getSubcontext("net.shibboleth.idp.authn.context.SubjectCanonicalizationContext");
                extCtx = authCtx.getSubcontext("net.shibboleth.idp.authn.context.ExternalAuthenticationContext");


                 usernameLookupStrategyClass
                        = Java.type("net.shibboleth.idp.session.context.navigate.CanonicalUsernameLookupStrategy");
                 usernameLookupStrategy = new usernameLookupStrategyClass();

                //code to check if authenticated user is allowed to impersonate to user “foo” for this relying party.
                …

               //experiment code to switch user’s identity to foo
               input.getSubcontext("net.shibboleth.idp.authn.context.SubjectContext", true).setPrincipalName("foo");

                UsernamePrincipalClass = Java.type("net.shibboleth.idp.authn.principal.UsernamePrincipal");
                UsernamePrincipal = new UsernamePrincipalClass("foo");

                SubjectClass = Java.type("javax.security.auth.Subject");
                s = new SubjectClass();
                s.getPrincipals().add(UsernamePrincipal);

                extCtx.setPrincipalName("foo");
                extCtx.setSubject(s);

                c14nCtx.setPrincipalName("foo");
                c14nCtx.setSubject(s);

                nextFlow;   // pass control to second factor or end with the first
            ]]>
            </value>
        </constructor-arg>
    </bean>

Thank you in advance,
Hong




-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170822/c01d2585/attachment.html>