InvalidNameIDPolicy occurs when using multi-factor authentication

[Noriyuki TAKEI]

Hi, Scott.

I found the problem about MFA settings.

I found out “input.removeSubcontext(resCtx)” is missing on the bottom of
mfa-authn-config.xml

My guess is as follows.Is this correct?

If previous statement is missing, resolverContex generated in MFA Script
affects main attribute resolution.
For example, when only uid attribute was added to resolverContex without
definition of “input.removeSubcontext(resCtx)”, only uid attribute is
available in main attribute resolution.

> Why do you think you need to resolve attributes during the MFA step? For
what purpose?

 I’d like authentication process to proceed to next flow depending on what
specific attribute is.For example,only when otpUseFlag attribute is true,
authentication process proceeds to next flow.


On Mon, Feb 4, 2019 at 23:07 Cantor, Scott <cantor.2 at osu.edu> wrote:

> On 2/4/19, 7:48 AM, "users on behalf of Noriyuki TAKEI" <
> users-bounces at shibboleth.net on behalf of ntakei at sios.com> wrote:
> > Is there any way to add an attribute to AttributeResolutionContext
> automatically
> > when new attributes are added to attributes-resolver.xml?
>
> That isn't what you want. You need to manipulate the MFA process to end up
> with a normalized principal name that matches whatever it is you need to
> feed into the "main" attribute resolution step later to get the results you
> need.
>
> The attribute resolution that happens inside the MFA logic has nothing to
> do with the "main" attribute lookup. You may not even need to be doing it.
> Why do you think you need to resolve attributes during the MFA step? For
> what purpose?
>
> -- Scott
>
>
> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190205/4896e976/attachment.html>