[External] Using SP Entity ID in RelationalDatabase Dataconnector

[Jeff Chapin]

profileContext.getSubcontext("net.shibboleth.idp.profile.context.RelyingPartyContext").getRelyingPartyId().
returned as a literal (with and without the "()" -- that has not seemed to
change the behavior yet).

I am looking at how to run a DB query in nashhorn now.

Jeff

On Fri, Mar 22, 2019 at 12:55 PM Jeff Chapin <jeff.chapin at uni.edu> wrote:

> Micheal,
>
> I had looked at that page previously, and had thought that using a
> dataconnector to run the query seemed easier than writing script that can
> independently run a query seemed more straight forward.
>
> I can certainly go that route, though.
>
> On Fri, Mar 22, 2019 at 12:30 PM Domingues, Michael D <
> michael-domingues at uiowa.edu> wrote:
>
>> Hi Jeff,
>>
>> I'll let others chime in on how (or if) you can use the entityID of a
>> particular relying party as a parameter to a query in a DataConnector. I
>> can tell you, however, that I'm pretty sure the entityID lives in a
>> different context —
>> "net.shibboleth.idp.profile.context.RelyingPartyContext" — which itself is
>> a subcontext of the profileContext.
>>
>> Given that, I think you'd use something like
>> profileContext.getSubcontext("net.shibboleth.idp.profile.context.RelyingPartyContext").getRelyingPartyId().
>> Once again, I leave the wisdom of such a solution to others; it's not how
>> we're doing it down the road.
>>
>> Instead, we're resolving all the relevant attributes in a scripted
>> context check (whether the user is eligible to use MFA, what their MFA
>> disposition is for all relying parties, etc) and then composing the result
>> in the script. You can find an example of a similar approach (minus the
>> particulars of your business rule) here:
>> https://wiki.shibboleth.net/confluence/display/IDP30/MultiFactorAuthnConfiguration#MultiFactorAuthnConfiguration-ProgrammaticallySelectingFlows
>>
>> Michael
>>
>> ------------------------------
>> *From:* users <users-bounces at shibboleth.net> on behalf of Jeff Chapin <
>> jeff.chapin at uni.edu>
>> *Sent:* Friday, March 22, 2019 12:06 PM
>> *To:* Shib Users
>> *Subject:* [External] Using SP Entity ID in RelationalDatabase
>> Dataconnector
>>
>> We are trying to implement Duo, and would like to add a 'useDuo'
>> attribute. If this is set to 'yes', that user should use Duo, and if not,
>> not.
>>
>> I have tried to set up a DataConnector with a RelationalDatabase to run
>> the following:
>>
>> select VARIABLE useDuo from dual;
>>
>> when Variable is something like '$requestContext.getPrincipalName()' or
>> 'resolutionContext.principal()' we successfully get the principal back, but
>> I cannot seem to figure out how to get the SP Entity ID. I have tried
>> things like:
>>
>> $requestContext.getRelyingPartyId() and
>> $resolutionContext.attributeRecipientID()
>>
>> which results in those stirngs *literally* being returned.
>>
>> Ultimately, we want to query a DB and see if a given user is forced to
>> use Duo or nor, based on business logic that is implemented and maintained
>> in the database.
>>
>>
>> Thanks,
>> Jeff
>>
>> --
>>
>> Jeff Chapin,
>>
>> Panther eSports Adviser
>> Assistant Systems/Applications Administrator
>> ITS-IS, University of Northern Iowa
>> Phone: 319-273-3162 Email: Jeff.Chapin at uni.edu
>>
>
>
> --
>
> Jeff Chapin,
>
> Panther eSports Adviser
> Assistant Systems/Applications Administrator
> ITS-IS, University of Northern Iowa
> Phone: 319-273-3162 Email: Jeff.Chapin at uni.edu
>


-- 

Jeff Chapin,

Panther eSports Adviser
Assistant Systems/Applications Administrator
ITS-IS, University of Northern Iowa
Phone: 319-273-3162 Email: Jeff.Chapin at uni.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190322/61b3ee86/attachment.html>