Mapping an x509 cert to one of multiple possible accounts

[Tony Plovich]

Hello,

I'm working on upgrading our Shibboleth installation to 3.x, and part of 
that is building a selection page where users can choose between the 
Password, SPNEGO, and X509 flows.  I'm doing this using custom events 
triggered from the login view and the MFA flow with some scripting.  
I've run into an issue in that our X509 certs can map to multiple 
accounts within our AD back-end, so I need a way to let the user choose 
one of their possible accounts.

In our current setup, the user supplies a username hint which gets anded 
with their cert's subject.  The anding takes place during attribute 
resolution, however, in moving to 3.x, I'd like to work this into the 
c14n process.

Right now I'm stuck on how to retrieve the hint form parameter from 
login.vm.  The Password flow config page talks about the 
"shibboleth.authn.Password.ExtendedFlowParameters" bean that's meant for 
just this purpose, but I haven't had any luck getting back the value I 
input.  The AuthenticationContext.getAuthenticationFlowState() method 
referenced in the docs doesn't exist when I try calling it from a test 
script within the MFA flow.

Once I know where the hint is stored, I'm thinking I could create a 
scripted attribute that pulls it out of the ResolutionContext object and 
passes it to the data connector used by the c14n attribute-sourced 
flow.  Ultimately, that DC needs to run a query with a filter like:

(&(sAMAcountName=$username_hint)(altSecurityIdentity=$X509_subject))

Any ideas on how this could be accomplished would be greatly appreciated.

Thanks,

-- 
Tony Plovich (aplovich at anl.gov)
Business Information Systems (BIS)
Argonne National Laboratory