Data connector resolutionPhases

[Pierre SAGNE]

Thanks for the hints.

So, to clarify, inside my MFA script, instead of using :

                     resCtx = 
input.getSubcontext("net.shibboleth.idp.attribute.resolver.context.AttributeResolutionContext", 
true);

I replace it by something like :

                     resCtx = new AttributeResolutionContext();

                     resCtx.setResolutionLabel("authn/MFA");

                     input.addSubcontext(resCtx, true);

And then use resolutionPhases="authn/MFA" in my DataConnector for my 
resolution to only take place inside my MFA script and not in other stages?

I'll try that, but If you can confirm that i correctly understood what 
you suggested, that would help to know i'm searching in the right direction.

Pierre Sagne.

Le 04/10/2024 à 16:59, Cantor, Scott a écrit :
>> So for now, there no case where it would work as intended, i
>> guess.
> Well, there are some cases specifically as I said, as long as you do the resolution yourself building the context by hand, and you put the ARC directly under the PRC, then you could depend on your label. And the standard resolution in the IdP will not see the label so exclude... will work in various cases.
>
> So, depends what you're doing, but it can work to a point. It's just not set really anywhere else by the IdP right now.
>
>> Even if it doesn't work, though, can you give some examples
>> of the step names that were meant to be used inside these
>> "resolutionPhases" parameters?
> I gravitated to using flow IDs when I was populating it in scripts, but then I ended up using "TOTP" alone when I used the resolver inside the TOTP plugin (and I would probably change that to authn/TOTP in a future major update).
>
> I would follow that general pattern in the future where it's applicable.
>
>> And although, is that the resolutionPhases filtering of data
>> connectors which doesn't work ? Or the whole
>> activationConditionRef mechanism for Data Connectors?
> General activation conditions work. and the RP shortcut conditions it wires in work. The resolutionLabel Spring wiring only works in a subset of cases, when the ARC is in a specific spot.
>
> 5.2 includes bug fixes for properly locating the PRC from the ARC and vice versa so that no matter where the contexts live things "can" work, but there's likely work to do to document some of it.
>
> The real answer is "do it and see", and you'll figure out pretty fast whether it's working.
>
> -- Scott
>
>