Multiple DuoOIDC -- Integration-Specific Principal Sets

[Cantor, Scott]

Ok, I think the problem is my example isn't complete, I seem to have missed a piece.

I haven't 100% satisfied myself that I'm not overlooking something but I don't think it works if you don't supply a special condition to guard Duo reuse.

My bean is the basic one that would be expected for the MFA flow approach, which checks that reuse only happens if the original result satisifies the new request.

Put the script bean at the end into global.xml and then set the property in duo-oidc.properties:

idp.authn.DuoOIDC.reuseCondition = my.DuoOIDCReuseCondition

That needs to be cleaned up and made simpler but I haven't had time to revisit it. The MFA flow does very little "extra" checking when you tell it to run something and it has a result to reuse, it just relies on the condition you can attach for now. It's designed to be a sharp knife and is a bit too sharp at the moment.

I'll get it added to the REFEDS article.

-- Scott

    <bean id="my.DuoOIDCReuseCondition" parent="shibboleth.Conditions.Scripted" factory-method="inlineScript">
        <constructor-arg>
            <value>
            <![CDATA[
                var reuse = false;
                var authnCtx = input.getSubcontext("net.shibboleth.idp.authn.context.AuthenticationContext");
                if (authnCtx != null) {
                    var mfaCtx = authnCtx.getSubcontext("net.shibboleth.idp.authn.context.MultiFactorAuthenticationContext");
                    if (mfaCtx != null) {
                        var active = mfaCtx.getActiveResults().get("authn/DuoOIDC");
                        if (active != null) {
                            reuse = authnCtx.isAcceptable(active);
                        }
                    }
                }
                reuse;
            ]]>
            </value>
        </constructor-arg>
    </bean>