IDPv3.3 and programmatically selecting MFA based on attribute

[Ho, PeiQuan]

I thought that's what I was trying to do.

* I set idp.authn.flows = MFA
* In authn/mfa-authn-config.xml, I want to decide whether to do Duo based on attribute eduPersonAssurance.  That attribute is merely a string.  If the value is " urn:tufts.edu:ac:classes:PasswordProtectedTransport:duo", I set the nextFlow as "authn/Duo".

This seems to be working except when the SSO scenario I had mentioned.

Thanks,
-PQ

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Thursday, March 23, 2017 11:55 AM
To: Shib Users <users at shibboleth.net>
Subject: RE: IDPv3.3 and programmatically selecting MFA based on attribute

> On 3.2.0, we use
> 	idp.authn.resolveAttribute = eduPersonAssurance Along with the 
> unicon/Duo libraries to determine MFA flow.  I guess you're saying 
> that's deprecated now.

The MFA flow is the *whole* thing, both factors. It needs to do the Password step and the Duo step and it needs to control when and whether they happen (to a point). That's the only flow you enable (unless you're doing something unrelated alongside like X.509 or something of that nature, and even then it's usually going to be best handled from within the MFA layer).

The example provided with the software illustrates how to resolve an attribute inside the MFA sequence and use it to decide what to do, to provide a starting point for development of the local logic required. Unlike the original feature, which was brittle and only usable in a tiny set of scenarios, the MFA rules can do anything you want them to do.

> As far as using an attribute within the MFA transition rules/scripts, 
> is it possible to retrieve a value from MySQL, similar to how you can 
> do it in the attribute-resolver.xml with a DataConnector?

You can write Java or Javascript code to do anything, but why would you? The resolver will do it for you and invoking the resolver is trivial now, which is what the example demonstrates.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net