Omit flow by value defined in attribute-resolver.xml

[Noriyuki TAKEI]

Hi,all.

I’m using MFA that consists of two flows(auth/Password and authn/Totp).

authn/Totp is new flow I have uniquely developed.

I would like to omit authn/Totp flow by value defined in
attribute-resolver.xml

For example,when totpFlg defined in attribute-resolver.xml is 1,omitting
authn/Totp Flow.

In order to achieve this,I defined as below in mfa-authn-config.xml.


<util:map id="shibboleth.authn.MFA.TransitionMap">
    <entry key="">
        <bean parent="shibboleth.authn.MFA.Transition"
p:nextFlowStrategy-ref="checkPasswordFlow" />
    </entry>

    <entry key="authn/Password">
        <bean parent="shibboleth.authn.MFA.Transition"
p:nextFlowStrategy-ref="checkTotpFlow" />
    </entry>

    <!-- An implicit final rule will return whatever the second flow
returns. -->
</util:map>

<bean id="checkPasswordFlow" parent="shibboleth.ContextFunctions.Scripted"
factory-method="inlineScript"
    p:customObject-ref="shibboleth.AttributeResolverService">
   ...omit...
</bean>

<bean id="checkTotpFlow" parent="shibboleth.ContextFunctions.Scripted"
factory-method="inlineScript"
    p:customObject-ref="shibboleth.AttributeResolverService">
    <constructor-arg>
        <value>
        <![CDATA[
            nextFlow = "authn/Totp";

            resCtx = input.getSubcontext(

"net.shibboleth.idp.attribute.resolver.context.AttributeResolutionContext",
true);

            usernameLookupStrategyClass =
Java.type("net.shibboleth.idp.session.context.navigate.CanonicalUsernameLookupStrategy");
            usernameLookupStrategy = new usernameLookupStrategyClass();
            resCtx.setPrincipal(usernameLookupStrategy.apply(input));

            resCtx.getRequestedIdPAttributeNames().add("totpFlg");
            resCtx.resolveAttributes(custom);
            attribute = resCtx.getResolvedIdPAttributes().get("totpFlg");
            valueType =
 Java.type("net.shibboleth.idp.attribute.StringAttributeValue");
            if (attribute != null && attribute.getValues().contains(new
valueType("1"))) {
                authCtx =
input.getSubcontext("net.shibboleth.idp.authn.context.AuthenticationContext");
                authResult =
Java.type("net.shibboleth.idp.authn.AuthenticationResult");
                subject =
input.getSubcontext("net.shibboleth.idp.authn.context.SubjectCanonicalizationContext").getSubject();
                authCtx.setAuthenticationResult( new
authResult("authn/Totp",subject));
                nextFlow = null;
            }
            nextFlow;
        ]]>
        </value>
    </constructor-arg>
</bean>

But,error as below occurred in idp-warn.log and I can not access the SP.

2018-05-15 23:22:27,140 - WARN
[net.shibboleth.idp.authn.impl.FinalizeAuthentication:179] - Profile Action
FinalizeAuthentication: Authentication result for flow authn/MFA did not
satisfy the request

I guess that AuthenticationResult is not set correcctly.

Does someone may give a hint?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180516/507e3107/attachment.html>