AW: SPNEGO as first factor in MFA

[Rabe, Jens]

Hi,

now i've tried to use a scripted firstfactor to if forceAuthn is active.

    <util:map id="shibboleth.authn.MFA.TransitionMap">
        <entry key="">
            <bean parent="shibboleth.authn.MFA.Transition" p:nextFlowStrategy-ref="checkFirstFactor" />
        </entry>

        <entry key="authn/SPNEGO">
            <bean parent="shibboleth.authn.MFA.Transition">
                <property name="nextFlowStrategyMap">
                     <map>
                        <entry key="AuthenticationException" value="authn/Password" />
                        <entry key="proceed" value-ref="checkSecondFactor" />
                    </map>
                </property>
            </bean>
        </entry>

        <entry key="authn/Password">
            <bean parent="shibboleth.authn.MFA.Transition">
                <property name="nextFlowStrategyMap">
                    <map>
                        <entry key="proceed" value-ref="checkSecondFactor" />
                    </map>
                </property>
            </bean>
        </entry>

    </util:map>
    
    <bean id="checkFirstFactor" parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript" p:customObject-ref="shibboleth.AttributeResolverService">
        <constructor-arg>
            <value>
            <![CDATA[
                logger = Java.type("org.slf4j.LoggerFactory").getLogger("net.shibboleth.idp.hsmw");

                nextFlow = "authn/SPNEGO";

                logger.info("firstFactor");
                authnContext = input.getSubcontext("net.shibboleth.idp.authn.context.AuthenticationContext");
                if (authnContext.isForceAuthn()) {
                    logger.info("forceAuthn is set, falling back to authn/Password");
                    nextFlow = "authn/Password";
                }

                nextFlow;
            ]]>
            </value>
        </constructor-arg>
    </bean>

And it works but if i authenticate at the service provide that requested the forceAuthn and after successful login i try to login at a service provide with SPNEGO and that fails with "Profile Action SelectSubjectCanonicalizationFlow: No potential flows left to choose from, canonicalization will fail".


I hope someone can help or understand my problem.

Thanks
Jens