MFA Flow Username Mangle Question

[Devin Ridge]

Hey all,

 

I’m trying to append a domain to uid, temporarily, for an authentication module in MFA flow. The first step is authn/Password with user credentials and the the next step is authn/privacyIDEA via a module. The issue is that uid, which we rely on in many places to not be scoped, needs to be scoped for the authn/privacyIDEA flow. As a proof-of-concept I’ve used authn/Function and it returns a hardcoded username with domain. I can verify the logs from the PrivacyIDEA module as well as the audit logs on PrivacyIDEA that the user 2FA’d successfully. Shibboleth of course doesn’t like that I just injected a username mid authentication, so I need to update the current context with the appended domain on the uid.

 

This is the simple PoC script I used:

<bean id="shibboleth.authn.Function.ResultLookupStrategy"

      parent="shibboleth.ContextFunctions.Scripted"

      factory-method="inlineScript">

    <constructor-arg>

        <value>

            <![CDATA[

                var username = “user at example.org”;

                username;

            ]]>

        </value>

    </constructor-arg>

</bean>

 

And included in my MFA authn:

    <util:map id="shibboleth.authn.MFA.TransitionMap">

        <entry key="">

            <bean parent="shibboleth.authn.MFA.Transition" p:nextFlow="authn/Password" />

        </entry>

 

        <entry key="authn/Password">

                <bean parent="shibboleth.authn.MFA.Transition" p:nextFlow="authn/Function" />

        </entry>

 

        <entry key="authn/Function">

                <bean parent="shibboleth.authn.MFA.Transition" p:nextFlow="authn/privacyIDEA" />

        </entry>

    </util:map>

 

My next step was to figure out how to get the authenticating user out of the current context and update it with a domain before it goes to the privacyIDEA module, which isn’t configurable on what attribute to accept as the user. How would I get the right context into my script and update the username? Am I even going about this the most efficient or correct way? Any help is appreciated.

 

Thanks,

Devin

 

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250711/6c998903/attachment.htm>