String(resolutionContext.getAttributeRecipientID()) returns null

[Rhian Resnick]

Afternoon,

We are having some difficulty in 3.3.1 executing the following mfa script where resCtx.getAttributeRecipientID() return null a similar call in attribute-resolver.xml also returns null when we load the eduPersonAssurance attribute.


The following in attribute-resolver.xml returns null in peerEntityId


        peerEntityId = String(resolutionContext.getAttributeRecipientID());

The following in authn/mfa-authn-config.xml returns null in peerEntityid


             resCtx = input.getSubcontext(
             peerEntityid = resCtx.getAttributeRecipientID()



Here is the full script from authn/mfa-authn-config.xml if it helps. Your thoughts are appreciated.




     <bean id="checkSecondFactor" parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript"
                p:customObject-ref="shibboleth.AttributeResolverService">
          <constructor-arg>
          <value>
                  <![CDATA[

                logger = Java.type("org.slf4j.LoggerFactory").getLogger("net.shibboleth.idp");
                // use this line when testing duo to make sure it works, usually it should be commented out
                //nextFlow = "authn/Duo";
                nextFlow = null;

                // Go straight to second factor if we have to, or set up for an attribute lookup first.
                authCtx = input.getSubcontext("net.shibboleth.idp.authn.context.AuthenticationContext");
                mfaCtx = authCtx.getSubcontext("net.shibboleth.idp.authn.context.MultiFactorAuthenticationContext");
                if (mfaCtx.isAcceptable()) {
                logger.info("**** is acceptable");


                // Attribute check is required to decide if first factor alone is enough.
                resCtx = input.getSubcontext(
                    "net.shibboleth.idp.attribute.resolver.context.AttributeResolutionContext", true);

                  // The following line returns null for getAttributeRecipientID()
                  logger.info("**** " + resCtx.getAttributeRecipientID() );

                // Look up the username
                usernameLookupStrategyClass = Java.type("net.shibboleth.idp.session.context.navigate.CanonicalUsernameLookupStrategy");
                usernameLookupStrategy = new usernameLookupStrategyClass();
                resCtx.setPrincipal(usernameLookupStrategy.apply(input));


                // resolve the attribute to determine if a first factor is sufficient
                resCtx.getRequestedIdPAttributeNames().add("eduPersonAssurance");
                resCtx.resolveAttributes(custom);

                // Check for an attribute value that authorizes use of first factor.
                attribute = resCtx.getResolvedIdPAttributes().get("eduPersonAssurance");
                valueType =  Java.type("net.shibboleth.idp.attribute.StringAttributeValue");
                if( attribute == null ) {
                        logger.info("**** duo attribute is null");

                }
                if (attribute != null && attribute.getValues().contains(new valueType("urn:mace:fau.edu:oit:security:mfa:duo"))) {
                        logger.info("**** duo yes");
                        nextFlow = "authn/Duo";
                }

                input.removeSubcontext(resCtx);   // cleanup
                }

                nextFlow;   // pass control to second factor or end with the first




        ]]>

          </value>
  </constructor-arg>
  </bean>




Rhian Resnick

Assistant Director Middleware and HPC

Office of Information Technology


Florida Atlantic University

777 Glades Road, CM22, Rm 173B

Boca Raton, FL 33431

Phone 561.297.2647

Fax 561.297.0222

 [image] <https://hpc.fau.edu/wp-content/uploads/2015/01/image.jpg>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170717/086ed79a/attachment-0001.html>