Selecting DuoOIDC 'config' based on user attribute in LDAP

[Cantor, Scott]

This might help a little bit, it's my strategy script for handling our standard and AAL3 level integrations for more secure services.

I've modified it to reflect what I would feed in as a custom object if I did need the resolver, though I do not use it. In my case, the integrations are a list because I iterate them looking for the first one that satisfies the request. It could be a map just as easily.

As you can see the result of the function is one of the actual integration objects, not a string. That's why you're failing.

-- Scott

<util:map id="osu.DuoCustomMap">
     <entry key="AttributeResolver"
	value-ref="shibboleth.AttributeResolverService" />
     <entry key="Integrations">
         <list>
           <ref bean="DuoOIDCDefault" />
           <ref bean="DuoOIDCAAL3" />
         </list>
    </entry>
</util:map>

    <bean id="shibboleth.authn.DuoOIDC.DuoIntegrationStrategy" parent="shibboleth.ContextFunctions.Scripted"
            factory-method="inlineScript"
            p:customObject-ref="osu.DuoCustomMap">
        <constructor-arg name="scriptSource">
        <value>
        <![CDATA[
        var duo = null;
        authCtx = input.getSubcontext("net.shibboleth.idp.authn.context.AuthenticationContext");
        var iter = custom.get("Integrations").iterator();
        while (duo == null && iter.hasNext()) {
            duo = iter.next();
            if (!authCtx.isAcceptable(duo)) {
                duo = null;
            }
        }
        duo;
        ]]>
        </value>
        </constructor-arg>
    </bean>