Selecting DuoOIDC 'config' based on user attribute in LDAP

[Abernathy, Jeff]

Scott, I think I see where you're headed here...

>> In the MFA handler the custom object is set as part of the
>> customobject-ref from MFA, but the customobject-ref needs to be reserved for the'
>> integration map to adjust the duo configs (I believe).

>You can add a layer of indirection. Map of custom objects, one of which is  a map of integrations.

So create another bean or two and flow through those with the first Duointegrationstrategy having customObject-ref of shibboleth.AttributeResolverService, and the two other beans having a customObject-ref DuoIntegrationMap?

Jeff

-----Original Message-----
From: Cantor, Scott <cantor.2 at osu.edu>
Sent: Thursday, November 2, 2023 7:28 AM
To: Shib Users <users at shibboleth.net>
Cc: Abernathy, Jeff <jeffabernathy at wustl.edu>
Subject: Re: Selecting DuoOIDC 'config' based on user attribute in LDAP

> This is what I was calling cloning the authn provider. Each was its own'
> authn flow at that point.

Yes. That's unsupported and will absolutely break upgrades. It is the cardinal sin. You cannot, under any circumstances, copy our flows, because they contain implementation classes and those change at any time.

> In the MFA handler the custom object is set as part of the
> customobject-ref from MFA, but the customobject-ref needs to be reserved for the'
> integration map to adjust the duo configs (I believe).

You can add a layer of indirection. Map of custom objects, one of which is  a map of integrations.

> Is there anything you could point us to in terms of documentation that
> would help? Is there a way to pass the attribute value from the MFA to
> DuoOIDC?

A few ways. There's a ScratchContext class in OpenSAML that just wraps a map and can be added to the context tree by the MFA logic and read back later, so that's one way.

-- Scott



________________________________
The materials in this message are private and may contain Protected Healthcare Information or other information of a sensitive nature. If you are not the intended recipient, be advised that any unauthorized use, disclosure, copying or the taking of any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error, please immediately notify the sender via telephone or return mail.