AW: SPNEGO as first factor in MFA

[Krenn, Martin]

Sorry, the script hat some iterations and is not clean. But I hope it helps.

Lg Martin

-----Ursprüngliche Nachricht-----
Von: users <users-bounces at shibboleth.net> Im Auftrag von Krenn, Martin via
users
Gesendet: Tuesday, April 1, 2025 4:40 PM
An: Shib Users <users at shibboleth.net>
Cc: Krenn, Martin <Martin.Krenn at uibk.ac.at>
Betreff: AW: SPNEGO as first factor in MFA

Hi,
this is my first factor script,
Which should do what you want?

Lg Martin 

        <value>
             <![CDATA[
             nextFlow = 'authn/Password';

             logger =
Java.type("org.slf4j.LoggerFactory").getLogger("net.shibboleth.idp.myscript.
selectFirstFactor");
             logger.debug('Starting selectFirstFactor');

             authCtx =
input.getSubcontext("net.shibboleth.idp.authn.context.AuthenticationContext"
);
             mfaCtx =
authCtx.getSubcontext("net.shibboleth.idp.authn.context.MultiFactorAuthentic
ationContext");
             var active = mfaCtx.getActiveResults();
             logger.info('mfa: active Authentication results:
'+active.size());
             // reuse
             if (active.size() > 0 && active.get("authn/Password") != null)
{
             } else if (active.size() > 0 && active.get("authn/SPNEGO") !=
null && !authCtx.isForceAuthn()) {
                logger.debug('got active SPNEGO and not forceAuthn');
                nextFlow = 'authn/SPNEGO';
             } else {

                 //check to see if SPNEGO can be activated
                 isSPNEGOActivated = custom.test(input);
                 logger.debug('Check if SPNEGO can be activated: ' +
isSPNEGOActivated );

                 if (!authCtx.isForceAuthn() && isSPNEGOActivated) {
                     logger.debug('Opt-in for SPNEGO and activationcondition
is set');
                     nextFlow = 'authn/SPNEGO';
                 }
             }
             nextFlow;
             ]]>

-----Ursprüngliche Nachricht-----
Von: users <users-bounces at shibboleth.net> Im Auftrag von Cantor, Scott via
users
Gesendet: Monday, March 31, 2025 2:14 PM
An: Shib Users <users at shibboleth.net>
Cc: Cantor, Scott <cantor.2 at osu.edu>
Betreff: Re: SPNEGO as first factor in MFA

> But I don't know how to decide if forceAuthn is active to jump to 
> Password?

If ForceAuthn is requested, there's a flag set in the AuthenticationContext
you can check to determine that and adjjust selected flows if that's what
you want to do.

Setting the SPNEGO flow to "support" it is not in general a correct thing to
do unless something prevents it from actually being used (alone) in a
ForceAuthn scenaio, and keeping the flag set to false is mainly what
prevents that.

If you want to use it as one of a set of factors and you know that at least
one of them will be run from scratch, then it might be reasonable to do.

-- Scott


--
For Consortium Member technical support, see
https://shibboleth.atlassian.net/wiki/x/ZYEpPw
To unsubscribe from this list send an email to
users-unsubscribe at shibboleth.net
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 8305 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20250401/8c57a082/attachment.p7s>