Forcing Duo by Service Provider

[Michael A Grady]

> On Mar 31, 2017, at 4:21 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> 
> On 3/31/17, 5:14 PM, "users on behalf of Andrew Morgan" <users-bounces at shibboleth.net on behalf of morgan at orst.edu> wrote:
> 
>> Does the resolutionContext exist during the MFA flow?  The behavior 
>> suggests it is only created/populated later.
> 
> I think your problem is that *your* script in the MFA rule isn't populating the recipientID field in the resolution context. You would have to do that step.
> 
> -- Scott
> 
> 

To ensure you get an "entityID" whether a SAML or CAS service, you need to get it this way currently in a scripted attribute: That reminds me we need to create an issue to ask that resolutionContext.getAttributeRecipientID() is populated for CAS also.

// Get the SP entityID or CAS service name into spEntityId
 <>        var spEntityId = profileContext.getSubcontext("net.shibboleth.idp.profile.context.RelyingPartyContext").getRelyingPartyId();


--
Michael A. Grady
IAM Architect, Unicon, Inc.



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170331/5dc3f36b/attachment-0001.html>