MFA Flow Username Mangle Question

[Steffen Hofmann]

Hi Devin,

alternatively, you can use my fudiscr plugin, which solves this problem:
https://doku.tid.dfn.de/en:shibidp:plugin-fudiscr

There are several variants for adding the realm/domain to the request to 
the backend. If you only need one realm for the configuration with 
privacyIDEA, it is sufficient to set the parameter
fudiscr.privacyidea.default_realm=<your realm>

You should also set at least the following parameters after installation:
fudiscr.challengeResponseClient=PrivacyIdeaChallengeResponseClient
fudiscr.privacyidea.base_uri=<uri to privacyIDEA API>
fudiscr.privacyidea.authorization_token=<generated token with pi-manage>

BR,

Steffen

Am 11.07.25 um 21:38 schrieb Devin Ridge via users:
>
> Hey all,
>
> I’m trying to append a domain to uid, temporarily, for an 
> authentication module in MFA flow. The first step is authn/Password 
> with user credentials and the the next step is authn/privacyIDEA via a 
> module. The issue is that uid, which we rely on in many places to not 
> be scoped, needs to be scoped for the authn/privacyIDEA flow. As a 
> proof-of-concept I’ve used authn/Function and it returns a hardcoded 
> username with domain. I can verify the logs from the PrivacyIDEA 
> module as well as the audit logs on PrivacyIDEA that the user 2FA’d 
> successfully. Shibboleth of course doesn’t like that I just injected a 
> username mid authentication, so I need to update the current context 
> with the appended domain on the uid.
>
> This is the simple PoC script I used:
>
> <bean id="shibboleth.authn.Function.ResultLookupStrategy"
>
> parent="shibboleth.ContextFunctions.Scripted"
>
> factory-method="inlineScript">
>
> <constructor-arg>
>
> <value>
>
> <![CDATA[
>
> var username = “user at example.org <mailto:user at example.org>”;
>
> username;
>
> ]]>
>
> </value>
>
> </constructor-arg>
>
> </bean>
>
> And included in my MFA authn:
>
> <util:map id="shibboleth.authn.MFA.TransitionMap">
>
> <entry key="">
>
> <bean parent="shibboleth.authn.MFA.Transition" 
> p:nextFlow="authn/Password" />
>
> </entry>
>
> <entry key="authn/Password">
>
> <bean parent="shibboleth.authn.MFA.Transition" 
> p:nextFlow="authn/Function" />
>
> </entry>
>
> <entry key="authn/Function">
>
> <bean parent="shibboleth.authn.MFA.Transition" 
> p:nextFlow="authn/privacyIDEA" />
>
> </entry>
>
> </util:map>
>
> My next step was to figure out how to get the authenticating user out 
> of the current context and update it with a domain before it goes to 
> the privacyIDEA module, which isn’t configurable on what attribute to 
> accept as the user. How would I get the right context into my script 
> and update the username? Am I even going about this the most efficient 
> or correct way? Any help is appreciated.
>
> Thanks,
>
> Devin
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250711/522ddd39/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 6280 bytes
Desc: Kryptografische S/MIME-Signatur
URL: <http://shibboleth.net/pipermail/users/attachments/20250711/522ddd39/attachment.p7s>