Applying MD driven and configured post-authentication flows

[John Schrader]

For the few SPs that need both context checks you might consider a
"RelyingPartyByTag" override to activate the SAML2.SSO.MDDriven profile.

in relying-party define:

      <bean id="rpmdd" parent="RelyingPartyByTag">
           <constructor-arg name="candidates">
               <list>
                   <bean parent="TagCandidate" c:name="custom:policy:rp"
                       p:values="mdd"/>
               </list>
           </constructor-arg>
           <property name="profileConfigurations">
               <list>
                   <bean id="rpmdd-b1" parent="SAML2.SSO.MDDriven" />
              </list>
           </property>
      </bean>

In the Metadata for the SPs add the EntityAttributes:

      <mdattr:EntityAttributes
xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute">

        <saml:Attribute xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
Name="custom:policy:rp "
            NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">

            <saml:AttributeValue>mdd</saml:AttributeValue>

        </saml:Attribute>

        <saml:Attribute xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
Name="http://shibboleth.net/ns/profiles/postAuthenticationFlows"
            NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">

            <saml:AttributeValue>context-check</saml:AttributeValue>
            <saml:AttributeValue>expiring-password</saml:AttributeValue>

        </saml:Attribute>

      </mdattr:EntityAttributes>


Then add EntityAttributes to configure the specifics for the SPs.

Just a thought....

-John S


On Mon, Nov 26, 2018 at 3:35 PM Ian Bobbitt <ibobbitt at globalnoc.iu.edu>
wrote:

> What's the best way to apply both metadata driven and IdP configured
> post-authentication flows?
>
> In my case, I want to apply the expiring-password intercept to all SPs,
> and a few SPs need custom context check intercepts.
>
> Adding an Attribute with Name
> http://shibboleth.net/ns/profiles/postAuthenticationFlows to the metadata
> for a SP seems
> to replace all p:authenticationFlows configured on SAML2.SSO.MDDriven in
> the relying party config rather than merging
> like I was hoping.
>
> I control all of the metadata here, so I don't need to sanitize external
> input by indirect filtering on tags, unless
> that ends up being easier.
>
> -- Ian
>
>
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net



-- 
John Schrader
Identity and Access Management
Office of Information Technologies
University of Notre Dame

EVERYTHING SHOULD BE MADE AS SIMPLE AS POSSIBLE, BUT NOT ANY SIMPLER
—ALBERT EINSTEIN
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20181127/27cc8db1/attachment.html>