MFA Flow Username Mangle Question

[Christopher Bongaarts]

On 7/11/2025 2:38 PM, Devin Ridge via users wrote:
>
> I’m trying to append a domain to uid, temporarily, for an 
> authentication module in MFA flow. The first step is authn/Password 
> with user credentials and the the next step is authn/privacyIDEA via a 
> module. The issue is that uid, which we rely on in many places to not 
> be scoped, needs to be scoped for the authn/privacyIDEA flow. As a 
> proof-of-concept I’ve used authn/Function and it returns a hardcoded 
> username with domain. I can verify the logs from the PrivacyIDEA 
> module as well as the audit logs on PrivacyIDEA that the user 2FA’d 
> successfully. Shibboleth of course doesn’t like that I just injected a 
> username mid authentication, so I need to update the current context 
> with the appended domain on the uid.
>
> [...]
>
> My next step was to figure out how to get the authenticating user out 
> of the current context and update it with a domain before it goes to 
> the privacyIDEA module, which isn’t configurable on what attribute to 
> accept as the user. How would I get the right context into my script 
> and update the username? Am I even going about this the most efficient 
> or correct way? Any help is appreciated.
>
An idea off the top of my head: if you add some scripts to the MFA 
transition map, you could grab the current username from the appropriate 
context and save in in the ScratchContext and then setting it to the 
scoped value prior to invoking the IDEA flow, then restoring it 
afterwards.  I think the Developer Resources has a diagram in the 
Authentication section showing where the username gets stashed.

-- 
%%  Christopher A. Bongaarts   %%cab at umn.edu          %%
%%  OIT - Identity Management  %%http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250711/7075b1b4/attachment.htm>