MFA authn flow - matching against multiple contexts?

[Greg Haverkamp]

On Tue, Dec 5, 2017 at 9:38 AM, Liam Hoekenga <liamr at umich.edu> wrote:

> We also accept "http://id.incommon.org/assurance/mfa" and "
> https://refeds.org/profile/mfa" as contexts that trigger MFA.
>
> This is ecmascript, but it's using the methods off of the java objects.
> Any suggestions on doing an intersection between the list of principals
> returned by rpCtx.getRequestedPrincipals and the list of principal names
> that includes all of the principal names that should trigger MFA?
>

Are you just trying to trigger a flow if one of the contexts is present?

IOW, you do Password, which should only get you Password or PPT, depending
on your configuration.

Is your required logic amenable to this:

mfaCtx =
authCtx.getSubcontext("net.shibboleth.idp.authn.context.MultiFactorAuthenticationContext");
if (mfaCtx.isAcceptable()) { return null; }  // current principals suffice
else { return nextFlow; } // run second factor

Greg
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171205/3243a4cb/attachment.html>