MFA flow with TOTP plugin

[Phil Chapman]

Hello,

I'm building a fresh v4.1 IdP with the MFA flow combining the Password flow and the TOTP plugin.  It is working, but I have a couple of questions:

1. When the example "checkSecondFactor" bean triggers an attribute query, the $resolutionContext.attributeRecipientID parameter is not populated (in the Attribute Resolver's <DataConnector><QueryTemplate>).  The SP triggering authentication is surely known, so is the absence of this value due to some limitation that I don't understand, or a bug?

2. If an SP didn't specify a preferred authentication method during initiation of the login, then is there any way for the SP to discover afterwards whether or not TOTP was used?  The idp.authn.TOTP.addDefaultPrincipals configuration property implies that urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken will be added to the results, but after successful 2FA the ShibAuthenticationMethod and ShibAuthnContextClass server variables still only show urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport

3. Again with the attribute resolver <QueryTemplate>, is there any remotely similar substitute for the deprecated $resolutionContext.principalAuthenticationMethod parameter?

Thank you,
Phil.

Disclaimer

The information contained in this communication from the sender is confidential. It is intended solely for use by the recipient and others authorized to receive it. If you are not the recipient, you are hereby notified that any disclosure, copying, distribution or taking action in relation of the contents of this information is strictly prohibited and may be unlawful.

This email has been scanned for viruses and malware, and may have been automatically archived by Mimecast Ltd, an innovator in Software as a Service (SaaS) for business. Providing a safer and more useful place for your human generated data. Specializing in; Security, archiving and compliance. To find out more visit the Mimecast website.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210528/7e852125/attachment.htm>