discoveryFunction selection

Martin Leonhartsberger m.leonhartsberger at cumulo.at
Tue Aug 15 18:00:20 UTC 2023


> There's a function in the API that does some magic around this, you might try using it and see what you get.
> net.shibboleth.idp.profile.context.navigate.WebFlowCurrentEventLookupFunction

I digged around a while, but it seems, that events of the previous flows are not available.
The only accessible context is a PreviousEventContext, but that contains something else. 
DEBUG [net.shibboleth.idp.authn:7] - PRC-Subcontexts: org.opensaml.profile.context.PreviousEventContext at 31bbe2d1
DEBUG [net.shibboleth.idp.authn:11] - toString() of org.opensaml.profile.context.PreviousEventContext at 31bbe2d1: NoCredentials

> If the event doesn't show up, then you would work around it by having the flow that's signaling the event also stash the information in a ScratchContext or a flow-scoped variable so your discovery function can access it there privately.
I wasn't able to work out an implementation of a createSubcontext with type ScratchContext, is there an example anywhere how to do that in a shibboleth.ContextFunctions.Scripted?

For reference on the mailing-list-archive, I solved it now as follows, possibly there is a better solution, but seems to do exactly what I wanted:

global.xml - created a CustomViewContext with an empty map
<util:map id="shibboleth.CustomViewContext">
    <entry key="mfaSignals">  
	<util:map />
    </entry>
</util:map>

mfa-authn-config.xml - using a contextFunction, resolving the EventContext and the event, saving the value to shibboleth.CustomViewContext
<bean id="checkSecondFactor" parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript" p:customObject-ref="shibboleth.CustomViewContext">
        <constructor-arg>
            <value>
            <![CDATA[
                nextFlow = "authn/SAML";

                logger = Java.type("org.slf4j.LoggerFactory").getLogger("net.shibboleth.idp.authn.mfa");
                events = input.getSubcontext("org.opensaml.profile.context.EventContext");
                custom["mfaSignals"].put("signal",events.getEvent());
..

saml-authn-config.xml - access the value
<bean id="shibboleth.authn.SAML.discoveryFunction" parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript" c:outputType="java.lang.String"
p:customObject-ref="shibboleth.CustomViewContext">
     <constructor-arg name="scriptSource">
          <value>
               <![CDATA[
               logger = Java.type("org.slf4j.LoggerFactory").getLogger("net.shibboleth.idp.authn.saml");
               custom["mfaSignals"];


Thanks for the hints!

-- Martin









More information about the users mailing list