MFA result reuse with Duo.

[Scott Koranda]

> > So what it does is check each requested Principal in
> > sequence, and determine if it can be satisfied. If not, it
> > looks for a flow to run that supports it. So I think it will
> > run the MFA flow (which will support both/all of course) in
> > such cases before it sees the second Principal and decides
> > to reuse the old result.
> 
> So yes, the MFA flow is running and yes, the script logic in
> my "next flow strategy" script is executing, but I see
> 
> java.lang.RuntimeException: javax.script.ScriptException:
> TypeError: null has no such function "getPrincipalName" in
> <eval> at line number 59
> 
> for this line in the script
> 
> username = input.getSubcontext("net.shibboleth.idp.authn.context.SubjectCanonicalizationContext").getPrincipalName();
> 
> So presumably the SubjectCanonicalizationContext is not
> available for some reason?
> 
> Can I walk the context tree and find another context from
> which to pull the principal tree? (I assume yes...)

(Apologies for replying to my own thread...)

Yes, by using the active result(s) from the
MultiFactorAuthenticationContext I can get the username, query
for attributes, and have the next flow strategy script logic
determine whether or not to invoke authn/Duo.

So it appears that yes, with

idp.authn.favorSSO = false

AND

<property name="defaultAuthenticationMethods">
  <list>
    <ref bean="MfaPrincipal" />
    <ref bean="PasswordPrincipal" />
  </list>
</property>

one can effectively control in the MFA next flow strategy
script logic whether or not the IdP re-uses an active password
result.

Scott K