Getting IdP attributes from proxy IdP

[Christopher Bongaarts]

On 2/1/2024 7:34 AM, Cantor, Scott wrote:
>> It looks like I can dig into the object "manually" (since I can fairly
>> confidently assume that the values are all StringAttributeValues in this
>> case) but is there a better way to do "is attribute value X among the
>> attribute values for attribute Y"?
> Not in that old a version, but the overall approach is also not ideal. I'd wire up a SimpleAttributePredicate bean and just apply it to the data.

Thanks for the tip - this seems to do the trick (I'm guessing it could 
be simplified a bit tho), as long as the SP does not ask for a specific 
AuthnContext (my weight map makes the IdP prefer to send our umn-URL 
over REFEDS).  If asked for a specific context, the IdP throws a 
NoAuthnContext error and logs indicate that none of the authn flows 
matched.  In authn.properties I have:

idp.authn.SAML.supportedPrincipals = \
urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport, \
urn:oasis:names:tc:SAML:2.0:ac:classes:Password, \
https://www.umn.edu/shibboleth/classes/authncontext/duo, \
https://refeds.org/profile/mfa

which I thought would be sufficient.  The 
shibboleth.AvailableAuthenticationFlows list in general-authn.xml is 
commented out, so it should be using the default flow descriptor for 
authn/SAML, which should be interpolating the above property, so I'm 
confused as to its refusal.

In relying-party.xml:

     <bean id="SAML2.SSO-NGWA" parent="SAML2.SSO"
p:inboundInterceptorFlows="#{{'security-policy/saml2-sso','noguestwifiauth'}}"
       p:skipEndpointValidationWhenSigned="true"
       p:postAuthenticationFlows="expiredpw">
       <property name="authnContextTranslationStrategyEx">
           <bean parent="shibboleth.Functions.Scripted" 
factory-method="inlineScript"
p:inputType="org.opensaml.profile.context.ProfileRequestContext"
                 p:outputType="java.util.Collection">
               <property name="customObject">
                   <bean 
class="net.shibboleth.idp.profile.logic.SimpleAttributePredicate">
                       <property name="attributeValueMap">
                           <map>
                               <entry key="amr">
<list><value>mfa</value></list>
                               </entry>
                           </map>
                       </property>
                       <!-- idp 4.2.0 gets the embedded 
profileRequestContext so
                       need to remove some of the Composes or redo with 
newer access beans -->
                       <property name="attributeContextLookupStrategy">
                           <bean parent="shibboleth.Functions.Compose"
c:g-ref="shibboleth.ChildLookup.AttributeContext">
                                 <constructor-arg name="f">
                                     <bean 
parent="shibboleth.Functions.Compose"
c:g-ref="shibboleth.ChildLookup.RelyingParty">
                                         <constructor-arg name="f">
                                             <bean 
parent="shibboleth.Functions.Compose"
c:g-ref="shibboleth.ChildLookup.ProfileRequestContext"
c:f-ref="shibboleth.ChildLookup.AuthenticationContext" />
                                         </constructor-arg>
                                     </bean>
                                 </constructor-arg>
                           </bean>
                       </property>
                   </bean>
               </property>

               <constructor-arg>
                   <value>
         <![CDATA[
                 logger = 
Java.type("org.slf4j.LoggerFactory").getLogger("net.shibboleth.idp.attribute.resolver.amr");
                 var Principal = 
Java.type("net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal");
                 var ArrayList = Java.type("java.util.ArrayList");

                 var hasMFA = custom.test(input);
                 logger.debug("Check if amr attribute contains mfa: {}", 
hasMFA);
                 result = new ArrayList();

                 if (hasMFA) {
                    result.add(new 
Principal("https://refeds.org/profile/mfa"));
                    result.add(new 
Principal("https://www.umn.edu/shibboleth/classes/authncontext/duo"));
                 } else {
                    result.add(new 
Principal("urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"));
                 }
                 result;
          ]]>
                   </value>
                </constructor-arg>
           </bean>
       </property>
     </bean>

-- 
%%  Christopher A. Bongaarts   %%cab at umn.edu           %%
%%  OIT - Identity Management  %%http://umn.edu/~cab   %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240201/4d072a92/attachment.htm>