MFA authn flow - matching against multiple contexts?

[Liam Hoekenga]

It looks like this was way easier than I was making it.  This seems to work

                var logger =
Java.type("org.slf4j.LoggerFactory").getLogger("net.shibboleth.idp.script.MFAflow");
                nextFlow = 'authn/remoteusertoken';

                authCtx =
input.getSubcontext("net.shibboleth.idp.authn.context.AuthenticationContext");
                mfaCtx =
authCtx.getSubcontext("net.shibboleth.idp.authn.context.MultiFactorAuthenticationContext");

                if (mfaCtx.isAcceptable()) {
                    nextFlow = null;
                }

                nextFlow;

I'll work on the attribute trigger later.



On Tue, Dec 5, 2017 at 5:04 PM, Liam Hoekenga <liamr at umich.edu> wrote:

> Are you just trying to trigger a flow if one of the contexts is present?
>>
>
> Yes.
>
> IOW, you do Password, which should only get you Password or PPT, depending
>> on your configuration.
>>
>
> In our pre-MFA flow configuration, we had an authentication flow that
> invoked Duo (via external auth) if any of these contexts was requested:
>     urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken
>     http://id.incommon.org/assurance/mfa
>     https://refeds.org/profile/mfa
>
> Is your required logic amenable to this:
>>
>> mfaCtx = authCtx.getSubcontext("net.shibboleth.idp.authn.context.Mult
>> iFactorAuthenticationContext");
>> if (mfaCtx.isAcceptable()) { return null; }  // current principals suffice
>> else { return nextFlow; } // run second factor
>>
>
> I don't yet need to trigger MFA based on a directory attribute, but will
> after we migrate from our legacy SSO to Shib as the primary authenticator.
>
> What I'm starting with is a combination of Jim Fox's suggestion in
> http://shibboleth.net/pipermail/users/2016-December/033096.html...
>
>       authCtx = input.getSubcontext("net.shibboleth.idp.authn.context.
> AuthenticationContext");
>       rpCtx = authCtx.getSubcontext("net.shibboleth.idp.authn.context.
> RequestedPrincipalContext");
>       if (rpCtx != null) {
>           rps = rpCtx.getRequestedPrincipals();
>           tkp = new AuthnContextClassRefPrincipal(
> "urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken");
>           if (rpCtx.getRequestedPrincipals().contains(tkp)) {
>             logger.debug("RP requested token login");
>           }
>       }
>
> and the wiki example (https://wiki.shibboleth.net/c
> onfluence/display/IDP30/MultiFactorAuthnConfiguration#MultiF
> actorAuthnConfiguration-ProgrammaticallySelectingFlows).
>
> How does isAcceptable() decide isAcceptable?  Is it the weight map in
> general-authn.xml?
>
> Liam
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171205/c2fa73d7/attachment.html>