<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
Hmm, close but not entirely there yet.
<div class=""><br class="">
</div>
<div class="">I am occasionally, but not consistently, getting the following error:</div>
<div class=""><strong class=""><br class="">
</strong></div>
<div class=""><strong class="">java.lang.RuntimeException: javax.script.ScriptException: TypeError: null has no such function "getPrincipalName" in <eval> at line number 10</strong></div>
<div class="">
<div class=""><br class="">
</div>
<div class="">which corresponds to:</div>
<div class=""><br class="">
</div>
<div class="">resCtx.setPrincipal(input.getSubcontext(<br class="">
"net.shibboleth.idp.authn.context.SubjectCanonicalizationContext").getPrincipalName());<br class="">
<br class="">
</div>
<div class="">so the SubjectCanonicalizationContext is coming back as null. It seems to only happen on a second trip through the IDP, when the first trip only used the first factor (auth/Password, using the stock JAAS password, backed against Krb5 if that
matters at all).</div>
<div class=""><br class="">
</div>
<div class="">The script I am using is exactly the one from the Wiki under "Conditional use of two factors" with authn/Password for Flow1, authn/Duo for Flow2, and the attribute name and value changed to eduPersonAssurance and "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"
respectively (my eduPersonAssurance returns either that, or our custom Duo contact class of
<a href="https://login.cmu.edu/duo" class="">https://login.cmu.edu/duo</a> )</div>
<div class=""><br class="">
</div>
<div class="">Any ideas? Is there a way to do any additional logging from the inline script to see why that context would be null?</div>
<div class=""><br class="">
</div>
<div class="">-jeaton</div>
<div class=""><br class="">
</div>
<div>
<blockquote type="cite" class="">
<div class="">On Jan 22, 2017, at 9:54 PM, Scott Koranda <<a href="mailto:skoranda@gmail.com" class="">skoranda@gmail.com</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div style="" class="">
<blockquote type="cite" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">
<blockquote type="cite" class="">Why is it just accepting the previous Password<br class="">
authentication and not checking the attribute (and then<br class="">
upgrading to Duo)?<br class="">
<br class="">
</blockquote>
<br class="">
This was covered in the past few days in another thread with<br class="">
the subject "MFA result reuse with Duo". You can find where it<br class="">
begins at<br class="">
<br class="">
<a href="http://marc.info/?l=shibboleth-users&m=148476673200662&w=2" class="">http://marc.info/?l=shibboleth-users&m=148476673200662&w=2</a><br class="">
<br class="">
In short:<span class="Apple-converted-space"> </span><br class="">
<br class="">
Since the SP does not request a "MFA context" and you<br class="">
have not configured an override for that SP that requires an<br class="">
"MFA context", the IdP determines that your active authn/MFA flow<br class="">
result with the Password context satisifes the request. As<br class="">
such it does not re-run the authn/MFA flow and your strategy<br class="">
script never gets the chance to execute a second time for that<br class="">
user.<br class="">
<br class="">
You can change that behavior by setting<br class="">
<br class="">
idp.authn.favorSSO = false<br class="">
<br class="">
in idp.properties and then adding<br class="">
<br class="">
<property name="defaultAuthenticationMethods"><br class="">
<list><br class="">
<ref bean="MfaPrincipal" /><br class="">
<ref bean="PasswordPrincipal" /><br class="">
</list><br class="">
</property><br class="">
<br class="">
to either an override for that particular SP or to the DefaultRelyingParty<br class="">
in relying-party.xml, where<br class="">
<br class="">
<bean id="MfaPrincipal" parent="shibboleth.SAML2AuthnContextClassRef"<span class="Apple-converted-space"> </span><br class="">
c:classRef="https://refeds.org/profile/mfa" /><br class="">
<br class="">
<bean id="PasswordPrincipal" parent="shibboleth.SAML2AuthnContextClassRef"<span class="Apple-converted-space"> </span><br class="">
c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" /><br class="">
<br class="">
(replace 'https://refeds.org/profile/mfa' with whatever you have<br class="">
configured your IdP to use as the MFA context).<br class="">
<br class="">
The order above is important--the "MfaPrincipal" must be first.<br class="">
<br class="">
With those changes, the IdP will run the authn/MFA flow if the user only has<br class="">
an active Password result.<br class="">
<br class="">
</blockquote>
<br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">I
have attempted to write this up. On this page</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<a href="https://wiki.shibboleth.net/confluence/display/IDP30/MultiFactorAuthnConfiguration" style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">https://wiki.shibboleth.net/confluence/display/IDP30/MultiFactorAuthnConfiguration</a><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">see
the section "Reuse of the Entire authn/MFA Flow Result (Or</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">When
Is a MFA Next Flow Strategy Executed?)"</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">Note
that Scott Cantor has not had a chance to review the text</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">yet.</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">The
technical details, however, have been verified by at least</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">one
other deployer (Josh O'Dowd) so it should work.</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">If
you have any comments on the text please let me know, or</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">feel
free to edit it yourself (it is, after all a wiki...)</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">Thanks,</span><br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<br style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class="">
<span style="font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">Scott
K</span></div>
</div>
</blockquote>
</div>
<br class="">
</div>
</body>
</html>