<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Mar 31, 2017, at 4:21 PM, Cantor, Scott <<a href="mailto:cantor.2@osu.edu" class="">cantor.2@osu.edu</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div class="">On 3/31/17, 5:14 PM, "users on behalf of Andrew Morgan" <<a href="mailto:users-bounces@shibboleth.net" class="">users-bounces@shibboleth.net</a> on behalf of <a href="mailto:morgan@orst.edu" class="">morgan@orst.edu</a>> wrote:<br class=""><br class=""><blockquote type="cite" class="">Does the resolutionContext exist during the MFA flow? The behavior <br class="">suggests it is only created/populated later.<br class=""></blockquote><br class="">I think your problem is that *your* script in the MFA rule isn't populating the recipientID field in the resolution context. You would have to do that step.<br class=""><br class="">-- Scott<br class=""><br class=""><br class=""></div></div></blockquote><br class=""></div><div>To ensure you get an "entityID" whether a SAML or CAS service, you need to get it this way currently in a scripted attribute: That reminds me we need to create an issue to ask that resolutionContext.getAttributeRecipientID() is populated for CAS also.</div><div><br class=""></div><div><pre style="margin-top: 0px; margin-bottom: 0px; padding: 0px; font-family: Consolas, Menlo, 'Liberation Mono', Courier, monospace; font-size: 12px; line-height: 1.4; color: rgb(51, 51, 51);" class=""><span class="cp" style="font-weight: 700; color: rgb(153, 153, 153);">// Get the SP entityID or CAS service name into spEntityId</span>
<a name="attribute-resolver.xml-147" style="color: rgb(53, 114, 176);" class=""></a><span class="cp" style="font-weight: 700; color: rgb(153, 153, 153);"> var spEntityId = profileContext.getSubcontext("net.shibboleth.idp.profile.context.RelyingPartyContext").getRelyingPartyId();</span></pre><div class=""><br class=""></div></div><br class=""><div class="">
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;">--<br class="">Michael A. Grady<br class="">IAM Architect, Unicon, Inc.</div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><br class="Apple-interchange-newline">
</div>
<br class=""></body></html>