[External Email] Re: Help getting username

[Jeffrey J Ramsay]

Hi Scott,

I am passing the c14n definition, but I'm stuck and decided to ask for help.

Also, I was trying to understand how this works for the view scope, but not
when I passed it to the setter.
<set name="viewScope.canonicalUsername"
value="CanonicalUsernameStrategy.apply(opensamlProfileRequestContext)" />

-- $IDP_HOME/flows/authn/Radius/radius-authn-beans.xml
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:context="
http://www.springframework.org/schema/context"
    xmlns:util="http://www.springframework.org/schema/util" xmlns:p="
http://www.springframework.org/schema/p" xmlns:c="
http://www.springframework.org/schema/c"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans.xsd
                           http://www.springframework.org/schema/context
http://www.springframework.org/schema/context/spring-context.xsd
                           http://www.springframework.org/schema/util
http://www.springframework.org/schema/util/spring-util.xsd"

    default-init-method="initialize" default-destroy-method="destroy">

    <bean
class="org.springframework.context.support.PropertySourcesPlaceholderConfigurer"
p:placeholderPrefix="%{"
        p:placeholderSuffix="}" />

    <bean
class="net.shibboleth.ext.spring.config.IdentifiableBeanPostProcessor" />
    <bean
class="net.shibboleth.idp.profile.impl.ProfileActionBeanPostProcessor" />

    <!-- Default static integration. -->
    <bean id="shibboleth.authn.radius.RadiusIntegration"
class="net.shibboleth.idp.authn.radius.RadiusShibboleth"
        p:radiusSecret="%{radius.secret:#{null}}"
        p:radiusHost="%{radius.host:#{null}}"
        p:radiusPort="%{radius.port:#{null}}" />

    <bean id="shibboleth.authn.radius.RadiusIntegrationStrategy"
class="com.google.common.base.Functions"
        factory-method="constant"
c:_0-ref="shibboleth.authn.radius.RadiusIntegration" />

    <!-- Default username comes from previous c14n or session. -->
    <bean id="shibboleth.authn.radius.UsernameLookupStrategy"

class="net.shibboleth.idp.session.context.navigate.CanonicalUsernameLookupStrategy"
/>

    <alias name="shibboleth.authn.radius.UsernameLookupStrategy"
alias="CanonicalUsernameStrategy" />

    <bean id="shibboleth.HttpServletRequestSupplier"

class="net.shibboleth.shared.servlet.impl.ThreadLocalHttpServletRequestSupplier"
/>

    <bean id="RadiusWebResponse" scope="prototype"
        class="net.shibboleth.idp.authn.radius.RadiusWebResponse"

p:usernameLookupStrategy-ref="shibboleth.authn.radius.UsernameLookupStrategy"
        p:request="HAMBURGER" />
</beans>

-- $IDP_HOME/flows/authn/Radius/radius-authn-flow.xml
<flow xmlns="http://www.springframework.org/schema/webflow" xmlns:xsi="
http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://www.springframework.org/schema/webflow
http://www.springframework.org/schema/webflow/spring-webflow.xsd"
    parent="authn.abstract">

     <view-state id="DisplayRadiusWebView" view="radius">
        <on-render>
            <evaluate expression="environment"
result="viewScope.environment" />
            <evaluate expression="opensamlProfileRequestContext"
result="viewScope.profileRequestContext" />
            <evaluate
expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext))"
result="viewScope.authenticationContext" />
            <evaluate
expression="authenticationContext.getSubcontext(T(net.shibboleth.idp.ui.context.RelyingPartyUIContext))"
result="viewScope.rpUIContext" />
            <evaluate
expression="T(net.shibboleth.utilities.java.support.codec.HTMLEncoder)"
result="viewScope.encoder" />
            <evaluate
expression="flowRequestContext.getExternalContext().getNativeRequest()"
result="viewScope.request" />
            <evaluate
expression="flowRequestContext.getExternalContext().getNativeResponse()"
result="viewScope.response" />
            <evaluate
expression="flowRequestContext.getActiveFlow().getApplicationContext().containsBean('shibboleth.CustomViewContext')
?

flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.CustomViewContext')
: null" result="viewScope.custom" />

            <set name="viewScope.RadiusIntegration"
value="flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.authn.radius.RadiusIntegrationStrategy').apply(opensamlProfileRequestContext)"
/>
            <set name="viewScope.canonicalUsername"
value="CanonicalUsernameStrategy.apply(opensamlProfileRequestContext)" />
            <set name="viewScope.radiusSecret"
value="RadiusIntegration.getRadiusSecret()" />
            <set name="viewScope.radiusHost"
value="RadiusIntegration.getRadiusHost()" />
            <set name="viewScope.radiusPort"
value="RadiusIntegration.getRadiusPort()" />

            <set name="viewScope.radiusScriptPath" value="'/js/radius.js'"
/>
        </on-render>

        <transition on="proceed" to="RadiusWebResponse" />
        <!--transition on="proceed" to="proceed" /-->
        <transition on="cancel" to="ReselectFlow" />
    </view-state>

    <action-state id="RadiusWebResponse">
        <evaluate expression="RadiusWebResponse" />
        <evaluate expression="'proceed'" />
        <transition on="proceed" to="proceed" />
        <transition to="DisplayRadiusWebView" />
    </action-state>

    <bean-import resource="radius-authn-beans.xml" />
</flow>

-- RadiusWebResponse.java
package net.shibboleth.idp.authn.radius;

import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import javax.servlet.http.HttpServletRequest;

public class RadiusWebResponse {
    private final Logger log =
LoggerFactory.getLogger(RadiusWebResponse.class);

    private String request;
    private String username;

    public void setRequest(String request) {
         log.info("SET STRING: " + request);
         this.request = request;
    }

    public void
setUsernameLookupStrategy(java.util.function.Function<org.opensaml.profile.context.ProfileRequestContext,
java.lang.String> strategy) {
         username =
net.shibboleth.idp.session.context.navigate.CanonicalUsernameLookupStrategy.apply(strategy);
         log.info("SET STRING: " + strategy);
    }
}

-- $IDP_HOME/logs/idp-process.log
2024-06-06 02:20:29,709 - 127.0.0.1 - INFO
[net.shibboleth.idp.authn.radius.RadiusWebResponse:20] - SET STRING:
HAMBURGER
2024-06-06 02:20:29,709 - 127.0.0.1 - INFO
[net.shibboleth.idp.authn.radius.RadiusWebResponse:35] - SET STRING:
net.shibboleth.idp.session.context.navigate.CanonicalUsernameLookupStrategy at 12114497

Thanks,
-Jeff

On Thu, Jun 6, 2024 at 9:16 AM Cantor, Scott <cantor.2 at osu.edu> wrote:

> > The username reference is just my thing but what I’m trying
> > to get is the id the user used in the auth/Password view. I am
> > able to produce it in my own view.
>
> There is no (reliable) way to get the value from that view/form
> specifically, only the value that's passed through the Password flow's
> subject c14n step and comes out at the end. Anything else would require
> being inside the Password flow itself. The intermediate data is essentially
> just working state.
>
> The most "typical" method used from inside the MFA flow to get that value
> is the one we default to for getting the name to pass along to Duo (or any
> other second factor service really), and that is, yes, the
> net.shibboleth.idp.session.context.navigate.CanonicalUsernameLookupStrategy
> function class.
>
> That's an API class and is ok to use, so manufacturing an instance of that
> (or wiring one up as a Spring bean) is probably what you want. You don't
> pass a function to it, you pass the ProfileRequestContext object into it as
> the input to apply().
>
> What that actually does is check for a SubjectCanonicalizationContext in
> the tree and the name inside it that presumably came from a previous factor
> (Password usually) and if it can't find that, it checks for a
> SessionContext that indicates a SSO session exists and pulls a name out of
> there. The latter is what allows step up to work.
>
> Point being that while that function is definitely ok to use, it does a
> specific thing that isn't necessarily the thing desired in every custom use
> case.
>
> -- Scott
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240606/c6b02416/attachment.htm>