[External Email] Re: Help getting username

[Cantor, Scott]

> The username reference is just my thing but what I’m trying
> to get is the id the user used in the auth/Password view. I am
> able to produce it in my own view.

There is no (reliable) way to get the value from that view/form specifically, only the value that's passed through the Password flow's subject c14n step and comes out at the end. Anything else would require being inside the Password flow itself. The intermediate data is essentially just working state.

The most "typical" method used from inside the MFA flow to get that value is the one we default to for getting the name to pass along to Duo (or any other second factor service really), and that is, yes, the net.shibboleth.idp.session.context.navigate.CanonicalUsernameLookupStrategy function class.

That's an API class and is ok to use, so manufacturing an instance of that (or wiring one up as a Spring bean) is probably what you want. You don't pass a function to it, you pass the ProfileRequestContext object into it as the input to apply().

What that actually does is check for a SubjectCanonicalizationContext in the tree and the name inside it that presumably came from a previous factor (Password usually) and if it can't find that, it checks for a SessionContext that indicates a SSO session exists and pulls a name out of there. The latter is what allows step up to work.

Point being that while that function is definitely ok to use, it does a specific thing that isn't necessarily the thing desired in every custom use case.

-- Scott