Getting the requesting SP's entityID during multi-factor script execution

[Wessel, Keith]

Hi, all,

Still working on my AWS and MFA challenge over here.

My allowedMethods attribute script is making sure that password authn isn't an allowed method if the requesting SP is AWS and the user is in one of the AD groups corresponding to an AWS group/role that requires MFA. That, of course, leaves Duo as the allowed method for those users.

The problem is that when the attribute script runs to populate values for the MFA script, the requesting SP seems to be unavailable. I tested this by logging the value of resolutionContext.getAttributeRecipientID(), and it's null. Of course, when the script runs later doing the normal attribute resolution work, the entityID of the SP is available.

Is there another way that I can get the SP's entityID inside my scripted attribute definition that might be available during the MFA flow execution?

Thanks,
Keith