MFA authn flow - matching against multiple contexts?

[Liam Hoekenga]

>
> Are you just trying to trigger a flow if one of the contexts is present?
>

Yes.

IOW, you do Password, which should only get you Password or PPT, depending
> on your configuration.
>

In our pre-MFA flow configuration, we had an authentication flow that
invoked Duo (via external auth) if any of these contexts was requested:
    urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken
    http://id.incommon.org/assurance/mfa
    https://refeds.org/profile/mfa

Is your required logic amenable to this:
>
> mfaCtx = authCtx.getSubcontext("net.shibboleth.idp.authn.context.Mult
> iFactorAuthenticationContext");
> if (mfaCtx.isAcceptable()) { return null; }  // current principals suffice
> else { return nextFlow; } // run second factor
>

I don't yet need to trigger MFA based on a directory attribute, but will
after we migrate from our legacy SSO to Shib as the primary authenticator.

What I'm starting with is a combination of Jim Fox's suggestion in
http://shibboleth.net/pipermail/users/2016-December/033096.html...

      authCtx =
input.getSubcontext("net.shibboleth.idp.authn.context.AuthenticationContext");
      rpCtx =
authCtx.getSubcontext("net.shibboleth.idp.authn.context.RequestedPrincipalContext");
      if (rpCtx != null) {
          rps = rpCtx.getRequestedPrincipals();
          tkp = new
AuthnContextClassRefPrincipal("urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken");
          if (rpCtx.getRequestedPrincipals().contains(tkp)) {
            logger.debug("RP requested token login");
          }
      }

and the wiki example (https://wiki.shibboleth.net/c
onfluence/display/IDP30/MultiFactorAuthnConfiguration#MultiF
actorAuthnConfiguration-ProgrammaticallySelectingFlows).

How does isAcceptable() decide isAcceptable?  Is it the weight map in
general-authn.xml?

Liam
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171205/eae93eb6/attachment-0001.html>