Selecting DuoOIDC 'config' based on user attribute in LDAP

[Abernathy, Jeff]

Scott and any other Java gurus,

I'm sorry to keep bothering you about this. I'm at wits end though, and your help feels to have gotten us so close.

I took what you meant to try and split things into some beans. Here's simplified versions:

<bean id="DuoOffPrem" parent="shibboleth.authn.DuoOIDC.DuoIntegration"
                p:APIHost="%{idp.DuoOffPrem.oidc.apiHost:none}"
        p:clientId="%{idp.DuoOffPrem.oidc.clientId:none}"
                p:secretKey="%{idp.duo.oidc.secretKey:none}" />

<bean id="DuoAlwaysOn" parent="shibboleth.authn.DuoOIDC.DuoIntegration"
                p:APIHost="%{idp.DuoAlwaysOn.oidc.apiHost:none}"
        p:clientId="%{idp.DuoAlwaysOn.oidc.clientId:none}"
                p:secretKey="%{idp.duo.oidc.secretKey:none}" />


<util:map id="DuoIntegrationMap">
        <entry key="default" value-ref="DuoOffPrem" />
        <entry key="AlwaysOn" value-ref="DuoAlwaysOn" />
        <entry key="OffPrem" value-ref="DuoOffPrem" /> </util:map>

<bean id="washu2fa_all_networks" parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript"
        p:customObject-ref="DuoIntegrationMap">
        <constructor-arg>
                <value>
                <![CDATA[
                        var logger = Java.type("org.slf4j.LoggerFactory").getLogger("org.example.duo.script");
                        logger.info("DuoOIDC In washu2fa_all_networks");
                        WhichDuo = custom.get("AlwaysOn");
                        WhichDuo
                ]]>
                </value>
        </constructor-arg>
</bean>

<bean id="washu2fa_external_networks" parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript"
        p:customObject-ref="DuoIntegrationMap">
        <constructor-arg>
                <value>
                <![CDATA[
                        var logger = Java.type("org.slf4j.LoggerFactory").getLogger("org.example.duo.script");
                        logger.info("DuoOIDC In washu2fa_external_networks");
                        WhichDuo = custom.get("OffPrem");
                        WhichDuo
                ]]>
                </value>
        </constructor-arg>
</bean>

<bean id="shibboleth.authn.DuoOIDC.DuoIntegrationStrategy" parent="shibboleth.ContextFunctions.Scripted"  factory-method="inlineScript"
        p:customObject-ref="shibboleth.AttributeResolverService">
        <constructor-arg>
                <value>
                        ..
                        resCtx.getRequestedIdPAttributeNames().add("wustlEduMFAOptions");
                        resCtx.resolveAttributes(custom);
                        attribute = resCtx.getResolvedIdPAttributes().get("wustlEduMFAOptions");
                               ...this brings back the right attribute.... yay!!!!
                        duo = attribute;
                        <or>
                        duo = "washu2fa_external_networks";
                        logger.info("DuoOIDC Calling Which Duo {}", duo);
                        duo;
                </value>
        </constructor-arg>
</bean>


The error we are getting is on that last 'duo' as you might expect. I'm trying to emulate what is in the MFA setup, but this one doesn't seem to want to handle the string as the 'next bean to call'.

2023-11-03 04:37:58,457 - INFO [org.example.duo.script:38] - DuoOIDC Calling Which Duo washu2fa_external_networks
2023-11-03 04:37:58,457 - ERROR [net.shibboleth.idp.authn:39] - Uncaught runtime exception
java.lang.ClassCastException: class java.lang.String cannot be cast to class net.shibboleth.idp.plugin.authn.duo.DuoOIDCIntegration (java.lang.String is in module java.base of loader 'bootstrap'; net.shibboleth.idp.plugin.authn.duo.DuoOIDCIntegration is in unnamed module of loader org.eclipse.jetty.webapp.WebAppClassLoader @505a9d7c)
        at net.shibboleth.idp.plugin.authn.duo.impl.PopulateDuoAuthenticationContext.doExecute(PopulateDuoAuthenticationContext.java:187)
2023-11-03 04:37:58,472 - WARN [org.opensaml.profile.action.impl.LogEvent:101] - A non-proceed event occurred while processing the request: RuntimeException

I feel like I'm really close, but frankly my java skills are terrible, so I am clearly missing a major construct of types here. I'm hoping its something simple and you can point me to a place learn or figure it out, or just show me the one line I'm missing. We're trying desperately to switch to the newer version of Duo , and this is a critical piece to allow us to preserve the option to have people opt in  (or be forced into ) an 'always on' duo model.


Thanks,
Jeff

-----Original Message-----
From: Cantor, Scott <cantor.2 at osu.edu>
Sent: Thursday, November 2, 2023 7:57 AM
To: Abernathy, Jeff <jeffabernathy at wustl.edu>; Shib Users <users at shibboleth.net>
Subject: Re: Selecting DuoOIDC 'config' based on user attribute in LDAP

> So create another bean or two and flow through those with the first
> Duointegrationstrategy having customObject-ref of
> shibboleth.AttributeResolverService, and the two other beans having a
> customObject-ref DuoIntegrationMap?

However many you need. When you need multiple custom objects for a script, you put them in a map or a list to tunnel them in. If one of those happens to be a map, that's fine, whatever the use case requires.

-- Scott



________________________________
The materials in this message are private and may contain Protected Healthcare Information or other information of a sensitive nature. If you are not the intended recipient, be advised that any unauthorized use, disclosure, copying or the taking of any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error, please immediately notify the sender via telephone or return mail.