Forcing Duo by Service Provider

[Andrew Morgan]

On Fri, 31 Mar 2017, Michael A Grady wrote:

>
>>> If you're talking routine attribute resolution, it should be set for 
>>> CAS. If you're talking MFA, *you* have to set it for either SAML or 
>>> CAS, or anything else, it's literally using whatever you tell it to 
>>> use.
>>>
>>> -- Scott
>>>
>>
>>
>> We had an email chain back in mid-February on this, where it was noted 
>> that Marvin wasn't populating resolution context for CAS, and to create 
>> an Issue for that. Which I just (finally) did. From back in 
>> mid-February:
>>
>
> And I imagine it should be a separate "improvement", but I noted in the 
> Issue I created that it would be a big bonus to make the CAS service 
> "groupname" available in the resolver, because given the fact that CAS 
> service urls tend to not be as "fixed" as SAML entityIDs, looking for 
> specific values might require just looking at the URL "prefix", or a 
> regular expression. Plus, one could ignore the CAS service URL 
> altogether, and manage the "list of CAS services where you want the 
> user/service 2FA calculation" by grouping, rather than by a list of 
> URLs.
>
> https://issues.shibboleth.net/jira/browse/IDP-1154


This sounds like exactly my problem, but only in the MFA flow:

------------------------------------------------------------------------
For a SAML SP, one can use:

resolutionContext.getAttributeRecipientID()

but for a CAS service, that does not provide the Service URL. One needs to 
fall back to getting it using this:

profileContext.getSubcontext("net.shibboleth.idp.profile.context.RelyingPartyContext").getRelyingPartyId();
------------------------------------------------------------------------

I was testing with a CAS service.  Calling 
resolutionContext.getAttributeRecipientID() worked when resolving an 
attribute after authentication had succeeded, but failed during the 
MFA flow (retrieving the scripted attribute from the MFA flow).

I would also like to have the CAS groupname available in attribute 
resolution for the reasons Michael listed.

 	Andy