Logic for mfa-authn-config.xml

[Andrew Morgan]

On Fri, 12 Jan 2018, Paul B. Henson wrote:

>> From: Andrew Morgan Sent: Friday, January 12, 2018 9:34 AM
>>
>> I was too lazy to give you my own MFA logic originally...  :)
>
> Laziness is a system administrator's best friend ;).
>
>> This MFA logic starts by asking if the previous authentication method
>
> Thanks for the example, that's very helpful. The one case it doesn't 
> cover though I think is where the SP doesn't require MFA, the user has 
> MFA available, but management has made an executive decision that that 
> particular application should not ask for MFA? To deal with that third 
> state, I think I need to tag SP's with an attribute as well as users.
>
> Thanks again...

Paul,

Here is how I made per-entityID decisions about invoking Duo (scripted 
attribute "needs_duo" again):

     <AttributeDefinition id="needs_duo" xsi:type="ScriptedAttribute">
         <Dependency ref="ONIDLDAP" />
         <Script><![CDATA[
             logger = Java.type("org.slf4j.LoggerFactory").getLogger("net.shibboleth.idp.attribute.resolver.needs_duo");
             duoflag = "0";
             for (i=0; i < ismemberof.getValues().size(); i++) {
                 tmp = ismemberof.getValues().get(i);
                 if (tmp.toLowerCase().equals("cn=duo-opt-in,ou=duo,ou=app,ou=is,ou=org,ou=osu,ou=grouper,ou=groups,o=orst.edu")) {
                     logger.debug("User is opted-in to Duo");
                     duoflag = "1";
                 }
             }
             rpid = profileContext.getSubcontext("net.shibboleth.idp.profile.context.RelyingPartyContext").getRelyingPartyId();
             logger.debug("rpid=" + rpid);
//            if (rpid.equals("http://people.oregonstate.edu/~morgan/CAS-1.3.4/test.php")) {
//                duoflag = "1";
//            }
//            if (rpid.equals("http://people.oregonstate.edu/~morgan/simplesaml/module.php/saml/sp/metadata.php/default-sp")) {
//                duoflag = "1";
//            }
             needs_duo.addValue(duoflag);
             logger.debug("needs_duo final value: " + needs_duo.getValues().get(0));
         ]]></Script>
     </AttributeDefinition>


Look at the part that is commented out to see how to make per-entityID 
choices.  You could easily write some logic that does "if (rpid == xxx) 
then duoflag=0" to skip Duo entirely for a specific entityID.  Just be 
careful how you nest the if/else statements!  :)

I'm not sure how to query entity attributes from a scripted attribute.

 	Andy