IDP 3.3: MFA validation and activationCondition problem

[Cantor, Scott]

On 1/13/17, 11:52 AM, "users on behalf of Koch, Ken" <users-bounces at shibboleth.net on behalf of ken at wustl.edu> wrote:

> Problem: The activationCondition in the general-authn.xml for SPNEGO is NOT firing.

If you want it to fire, just apply it using your script(s). The MFA feature is designed to give you control, not second-guess you. That second-guessing and automated behavior is what people have been working overtime to circumvent in the previous versions, so it doesn't run here. If you tell the system to run the authn/MFA flow, it runs it (or reuses a result from it), it doesn't do it conditionally.

If you want to do it conditionally, you have the freedom to do so, just write a simple script to apply the condition(s) you want to apply and transition out of the script.

This is the same as the last question about supportedPrincipal evaluation of the flow before using it. Normally the IdP checks that before running a flow or reusing a flow result. With MFA, it doesn't, it assumes you know what you're doing when you tell it what to do and that you did the checking you want to do.

In the case of a condition that's already attached via other means, you can do so if you prefer without repeating or injecting that condition separately, but it's often easier to just pull the activationCondition bean over and move it to a bean injected into a script rather than keep it over in the other place.

If you wanted to apply it without moving it over, you'd need to get hold of the SPNEGO AuthenticationFlowDescriptor and do descriptor.apply(input), basically. I doubt it's warranted in your case though.

-- Scott