MFA and authn/OIDCRelyingParty as second factor

[Pierre SAGNE]

Hi,

I am currently trying to use the MFA in the following way :

* First, authenticate with authn/Password (LDAP) (first factor)

* then, use authn/OIDCRelyingParty to delegate authentication to another 
OP which can use some more secure authentication (like TOTP and other 
things) (second factor)

* finally I want to make sure that the identiy of the user is the same 
in my first factor and my second factor, and it is where things are more 
complicated.

I have a "mail/email" attribute which i can compare in both IdPs.

I try to do it inside a MFA strategy, after my authn/OIDCRelyingParty 
authentication.

The problem is that the principal I get using 
usernameLookupStrategy.apply(input) in my strategy is modified after the 
authn/OIDCRelyingParty authentication (it is now the sub I received).

So I can no longer resolve my LDAP mail address.

And I cannot resolve my "upstream_mail" either, which is defined like this :

     <AttributeDefinition id="upstream_mail" 
xsi:type="SubjectDerivedAttribute" principalAttributeName="email"/>

The problem only occurs inside the MFA post second factor strategy though.

If I do the exact same thing inside a context check interceptor, I get 
the right principal and both my attributes are correctly resolved : mail 
from LDAP and upstream_mail from the OIDC OP.

Is there a subtlety I am missing if I want to do it inside a MFA 
strategy (which would be cleaner for my use case), or is doing it inside 
the context check interceptor my only solution?

Best regards,

-- 
Pierre Sagne.