Forcing Duo by Service Provider

[Andrew Morgan]

On Fri, 31 Mar 2017, Michael A Grady wrote:

>
>> On Mar 31, 2017, at 4:21 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
>>
>> On 3/31/17, 5:14 PM, "users on behalf of Andrew Morgan" <users-bounces at shibboleth.net on behalf of morgan at orst.edu> wrote:
>>
>>> Does the resolutionContext exist during the MFA flow?  The behavior
>>> suggests it is only created/populated later.
>>
>> I think your problem is that *your* script in the MFA rule isn't 
>> populating the recipientID field in the resolution context. You would 
>> have to do that step.
>>
>> -- Scott
>>
>>
>
> To ensure you get an "entityID" whether a SAML or CAS service, you need 
> to get it this way currently in a scripted attribute: That reminds me we 
> need to create an issue to ask that 
> resolutionContext.getAttributeRecipientID() is populated for CAS also.
>
> // Get the SP entityID or CAS service name into spEntityId
> <>        var spEntityId = profileContext.getSubcontext("net.shibboleth.idp.profile.context.RelyingPartyContext").getRelyingPartyId();

Adding this to my scripted attribute definition worked, even when it was 
called from the MFA flow:

     <AttributeDefinition id="needs_duo" xsi:type="ScriptedAttribute">
         <Dependency ref="ONIDLDAP" />
         <Script><![CDATA[
             logger = Java.type("org.slf4j.LoggerFactory").getLogger("net.shibboleth.idp.attribute.resolver.needs_duo");
             duoflag = "0";
             for (i=0; i < ismemberof.getValues().size() - 1; i++) {
                 tmp = ismemberof.getValues().get(i);
                 if (tmp.toLowerCase().equals("cn=duo-opt-in,ou=duo,ou=app,ou=is,ou=org,ou=osu,ou=grouper,ou=groups,o=orst.edu")) {
                     logger.debug("User is opted-in to Duo");
                     duoflag = "1";
                 }
             }
             //rpid = resolutionContext.getAttributeRecipientID();
             rpid = profileContext.getSubcontext("net.shibboleth.idp.profile.context.RelyingPartyContext").getRelyingPartyId();
             logger.debug("rpid=" + rpid);
             if (rpid.equals("http://people.oregonstate.edu/~morgan/CAS-1.3.4/test.php")) {
                 duoflag = "1";
             }
             needs_duo.addValue(duoflag);
             logger.debug("needs_duo final value: " + needs_duo.getValues().get(0));
         ]]></Script>
     </AttributeDefinition>


It seems to be populating the entityID for CAS services too.  This example 
above is a CAS service, and the logs contain:

2017-03-31 14:43:43,581 - INFO [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:152] - Profile Action ValidateUsernamePasswordAgainstLDAP: Login by 'morgana' succeeded
2017-03-31 14:43:43,605 - DEBUG [checkSecondFactor:4] - Starting checkSecondFactor
2017-03-31 14:43:43,691 - DEBUG [net.shibboleth.idp.attribute.resolver.needs_duo:12] - rpid=http://people.oregonstate.edu/~morgan/CAS-1.3.4/test.php
2017-03-31 14:43:43,693 - DEBUG [net.shibboleth.idp.attribute.resolver.needs_duo:17] - needs_duo final value: 1

 	Andy