Selecting DuoOIDC 'config' based on user attribute in LDAP

[Abernathy, Jeff]

Hi Scott,

Thanks for the reply. We're having trouble translating the old MFA way of doing it that is shown in the documentation, to doing that within DuoOIDC. Here's some of our code:


Old way from within mfa-authn-config.xml:

<bean id="additionalStrategies" parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript"
            p:customObject-ref="shibboleth.AttributeResolverService">
        <constructor-arg>
            <value>
                <![CDATA[
                ....
                            resCtx.setPrincipal(username);
                            resCtx.getRequestedIdPAttributeNames().add("wustlEduMFAOptions");
                            resCtx.resolveAttributes(custom);
                            attribute = resCtx.getResolvedIdPAttributes().get("wustlEduMFAOptions");
                // attribute is multi-valued, so first match is prioritized highest
                                if (attribute.getValues().contains(new valueType("washu2fa_all_networks"))) {
                                    logger.debug("MFA additionalStrategies Attr: nextFlow set to washu2fa_all_networks");
                                    //nextFlow = "authn/duo_washu2fa_all_networks";
                                                                        nextFlow = "authn/DuoAlwaysOn";
                                } else if (attribute.getValues().contains(new valueType("washu2fa_external_networks"))) {
                                    logger.debug("MFA additionalStrategies Attr: nextFlow set to washu2fa_external_networks");
                                    //nextFlow = "authn/duo_washu2fa_external_networks";
                                                                        nextFlow = "authn/DuoOffPrem";
                                }

And then there was duo_washu2fa_all_networks-authn-config.xml and duo_waushu2fa_external_networks-authn-config.xml to match those flows. Each had its own BasicDuoIntegration, DuoIntegrationMap, and DuoIntegrationStrategy that only had one Duo config embedded in it. This is what I was calling cloning the authn provider. Each was its own authn flow at that point.

Trying to convert that to duo-oidc-authn-config.xml:

<util:map id="DuoIntegrationMap">
        <entry key="default" value-ref="DuoOffPrem" />
        <entry key="AlwaysOn" value-ref="DuoAlwaysOn" />
        <entry key="OffPrem" value-ref="DuoOffPrem" />
</util:map>

<bean id="shibboleth.authn.DuoOIDC.DuoIntegrationStrategy" parent="shibboleth.ContextFunctions.Scripted"
                factory-method="inlineScript"
        p:customObject-ref="DuoIntegrationMap">
        <constructor-arg>
                <value>
                <![CDATA[
                        ...
                        atrCtx = input.getSubcontext("shibboleth.AttributeResolverService");

In the MFA handler the custom object is set as part of the customobject-ref from MFA, but the customobject-ref needs to be reserved for the integration map to adjust the duo configs (I believe).

Honestly, this is just one of the ways we have tried to instantiate something to retrieve the attribute. Probably about a dozen different ways. We can't find the appropriate example or understand the documentation to be applicable. Is there anything you could point us to in terms of documentation that would help? Is there a way to pass the attribute value from the MFA to DuoOIDC?


Thanks for any tips aiming us in the right direction

Jeff Abernathy
Washington University

-----Original Message-----
From: Cantor, Scott <cantor.2 at osu.edu>
Sent: Thursday, November 2, 2023 6:51 AM
To: Shib Users <users at shibboleth.net>
Cc: Abernathy, Jeff <jeffabernathy at wustl.edu>
Subject: Re: Selecting DuoOIDC 'config' based on user attribute in LDAP

Both old and new Duo flows have always had support for this, and certainly not be "cloning" anything. You build a strategy function for deriving the configuration to use, and there are bean names reserved for that. There are examples in the documentation.

As far as using an attribute to derive it, look at the examples in the MFA documentation around scripting that, the same approach would apply here.

-- Scott



________________________________
The materials in this message are private and may contain Protected Healthcare Information or other information of a sensitive nature. If you are not the intended recipient, be advised that any unauthorized use, disclosure, copying or the taking of any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error, please immediately notify the sender via telephone or return mail.