Attempting to use 'resourceScript' to see if a second factor is needed

[Jeff Chapin]

We are upgrading from IDP 3 to IDP 4. In 3, we used an external script to
determine if a particular login needed to use MFA or not. This is the bean
we had working:

    <bean id="checkSecondFactor"
        parent="shibboleth.ContextFunctions.Scripted"
        factory-method="resourceScript"
        c:resource="checkSecondFactor.js"
        p:customObject-ref="shibboleth.AttributeResolverService"/>

When upgrading to IDP 4, this no longer seems to work. the core issue
appears to be:

2021-09-23 09:20:37,529 - WARN
[net.shibboleth.ext.spring.context.FilesystemGenericWebApplicationContext:591]
- Exception encountered during context initialization - cancelling refresh
attempt: org.springframework.beans.factory.BeanCreationException: Error
creating bean with name 'shibboleth.authn.MFA.TransitionMap': Cannot create
inner bean 'shibboleth.authn.MFA.Transition$child#6d5db4e0' of type
[net.shibboleth.idp.authn.MultiFactorAuthenticationTransition] while
setting bean property 'sourceMap' with key [TypedStringValue: value
[authn/External], target type [null]]; nested exception is
org.springframework.beans.factory.BeanCreationException: Error creating
bean with name 'shibboleth.authn.MFA.Transition$child#6d5db4e0' defined in
file [/01/shib01/current/conf/authn/mfa-authn-config.xml]: Cannot resolve
reference to bean 'checkSecondFactor' while setting bean property
'nextFlowStrategy'; nested exception is
org.springframework.beans.factory.BeanCreationException: Error creating
bean with name 'checkSecondFactor' defined in file
[/01/shib01/current/conf/authn/mfa-authn-config.xml]: Bean instantiation
via factory method failed; nested exception is
org.springframework.beans.BeanInstantiationException: Failed to instantiate
[net.shibboleth.idp.profile.context.navigate.ScriptedContextLookupFunction]:
Factory method 'resourceScript' threw exception; nested exception is
java.io.FileNotFoundException: class path resource
[net/shibboleth/idp/flows/authn/checkSecondFactor.js] cannot be opened
because it does not exist

For the life of me, I cannot figure out where we are supposed to put this
script -- I have tried creating the path 'net/shibboleth/idp/flows/authn/'
in several different locations, and putting the script there, and it always
fails with the same error.

The documentation here
https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1279033528/ScriptedContextFunction
implies that we can use absolute paths, or variables, but when I do that,
whatever value I set is *prefixed* by 'net/shibboleth/idp/flows/authn/'.
I'm not sure what I am doing wrong, or where the 'net' directory should be
created, or if I am running into unexpected behavior.

Any advice would be appreciated,
Jeff

-- 

Jeff Chapin,

Panther eSports Adviser
Assistant Systems/Applications Administrator
ITS-IS, University of Northern Iowa
Phone: 319-273-3162 Email: Jeff.Chapin at uni.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210923/c40edc7f/attachment.htm>