Multiple DuoOIDC -- Integration-Specific Principal Sets

[Schwendner, Joanne]

That reuseCondition script definitely helped!  I'm no longer getting the
error.
We will be doing extensive testing of this.  I'll send updates if we find
anything.

Many thanks!

Joanne

---

Joanne Schwendner
Identity Services
Office of Information Technology
Brown University


On Fri, Sep 20, 2024 at 11:47 AM Cantor, Scott via users <
users at shibboleth.net> wrote:

> Ok, I think the problem is my example isn't complete, I seem to have
> missed a piece.
>
> I haven't 100% satisfied myself that I'm not overlooking something but I
> don't think it works if you don't supply a special condition to guard Duo
> reuse.
>
> My bean is the basic one that would be expected for the MFA flow approach,
> which checks that reuse only happens if the original result satisifies the
> new request.
>
> Put the script bean at the end into global.xml and then set the property
> in duo-oidc.properties:
>
> idp.authn.DuoOIDC.reuseCondition = my.DuoOIDCReuseCondition
>
> That needs to be cleaned up and made simpler but I haven't had time to
> revisit it. The MFA flow does very little "extra" checking when you tell it
> to run something and it has a result to reuse, it just relies on the
> condition you can attach for now. It's designed to be a sharp knife and is
> a bit too sharp at the moment.
>
> I'll get it added to the REFEDS article.
>
> -- Scott
>
>     <bean id="my.DuoOIDCReuseCondition"
> parent="shibboleth.Conditions.Scripted" factory-method="inlineScript">
>         <constructor-arg>
>             <value>
>             <![CDATA[
>                 var reuse = false;
>                 var authnCtx =
> input.getSubcontext("net.shibboleth.idp.authn.context.AuthenticationContext");
>                 if (authnCtx != null) {
>                     var mfaCtx =
> authnCtx.getSubcontext("net.shibboleth.idp.authn.context.MultiFactorAuthenticationContext");
>                     if (mfaCtx != null) {
>                         var active =
> mfaCtx.getActiveResults().get("authn/DuoOIDC");
>                         if (active != null) {
>                             reuse = authnCtx.isAcceptable(active);
>                         }
>                     }
>                 }
>                 reuse;
>             ]]>
>             </value>
>         </constructor-arg>
>     </bean>
>
>
>
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240920/e1a58461/attachment.htm>