<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Helvetica,sans-serif;" dir="ltr">
<p>Afternoon,</p>
<p><br>
We are having some difficulty in 3.3.1 executing the following mfa script where<span style="background-color: rgb(255, 255, 255);"> </span><span style="font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 16px; background-color: rgb(255, 255, 255);">resCtx.getAttributeRecipientID()
return null a similar call in attribute-resolver.xml also returns null when we load the eduPersonAssurance attribute. </span></p>
<p><span style="font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 16px; background-color: rgb(255, 255, 255);"><br>
</span></p>
<p><span style="font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 16px; background-color: rgb(255, 255, 255);">The following in attribute-resolver.xml
returns null in peerEntityId</span></p>
<p><span style="font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 16px; background-color: rgb(255, 255, 255);"><br>
</span></p>
<p><span style="font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 16px; background-color: rgb(255, 255, 255);"></p>
<div> peerEntityId = String(resolutionContext.getAttributeRecipientID());</div>
<div><br>
</div>
The following in <span>authn/mfa-authn-config.xml returns null in peerEntityid</span></span>
<p></p>
<p><span style="font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 16px; background-color: rgb(255, 255, 255);"><span><br>
</span></span></p>
<p><span style="font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 16px; background-color: rgb(255, 255, 255);"><span></p>
<div> resCtx = input.getSubcontext(</div>
<div> peerEntityid = resCtx.getAttributeRecipientID()</div>
<br>
</span></span>
<p></p>
<p><span style="font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 16px; background-color: rgb(255, 255, 255);"><br>
</span></p>
<p>Here is the full script from authn/mfa-authn-config.xml if it helps. Your thoughts are appreciated. </p>
<p><span style="font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols; font-size: 16px; background-color: rgb(255, 255, 255);"></span></p>
<p><br>
</p>
<p><br>
</p>
<p><br>
</p>
<p></p>
<div> <bean id="checkSecondFactor" parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript"</div>
<div> p:customObject-ref="shibboleth.AttributeResolverService"></div>
<div> <constructor-arg></div>
<div> <value></div>
<div> <![CDATA[</div>
<div><br>
</div>
<div> logger = Java.type("org.slf4j.LoggerFactory").getLogger("net.shibboleth.idp"); </div>
<div> // use this line when testing duo to make sure it works, usually it should be commented out</div>
<div> //nextFlow = "authn/Duo";</div>
<div> nextFlow = null;</div>
<div><br>
</div>
<div> // Go straight to second factor if we have to, or set up for an attribute lookup first.</div>
<div> authCtx = input.getSubcontext("net.shibboleth.idp.authn.context.AuthenticationContext");</div>
<div> mfaCtx = authCtx.getSubcontext("net.shibboleth.idp.authn.context.MultiFactorAuthenticationContext");</div>
<div> if (mfaCtx.isAcceptable()) {</div>
<div> logger.info("**** is acceptable"); </div>
<div><br>
</div>
<div> </div>
<div> // Attribute check is required to decide if first factor alone is enough.</div>
<div> resCtx = input.getSubcontext(</div>
<div> "net.shibboleth.idp.attribute.resolver.context.AttributeResolutionContext", true);</div>
<div> </div>
<div><span style="background-color: rgb(255, 255, 0);"> // The following line returns null for getAttributeRecipientID() </span></div>
<div><span style="background-color: rgb(255, 255, 0);"> logger.info("**** " + resCtx.getAttributeRecipientID() ); </span></div>
<div>
<div> </div>
<div> // Look up the username</div>
<div> usernameLookupStrategyClass = Java.type("net.shibboleth.idp.session.context.navigate.CanonicalUsernameLookupStrategy");</div>
<div> usernameLookupStrategy = new usernameLookupStrategyClass();</div>
<div> resCtx.setPrincipal(usernameLookupStrategy.apply(input));</div>
<div> </div>
<div> </div>
<div> // resolve the attribute to determine if a first factor is sufficient</div>
<div> resCtx.getRequestedIdPAttributeNames().add("eduPersonAssurance");</div>
<div> resCtx.resolveAttributes(custom);</div>
<div> </div>
<div> // Check for an attribute value that authorizes use of first factor.</div>
<div> attribute = resCtx.getResolvedIdPAttributes().get("eduPersonAssurance");</div>
<div> valueType = Java.type("net.shibboleth.idp.attribute.StringAttributeValue");</div>
<div> if( attribute == null ) {</div>
<div> logger.info("**** duo attribute is null"); </div>
<div><br>
</div>
<div> }</div>
<div> if (attribute != null && attribute.getValues().contains(new valueType("urn:mace:fau.edu:oit:security:mfa:duo"))) {</div>
<div> logger.info("**** duo yes"); </div>
<div> nextFlow = "authn/Duo";</div>
<div> }</div>
<div> </div>
<div> input.removeSubcontext(resCtx); // cleanup</div>
<div> }</div>
<div><br>
</div>
<div> nextFlow; // pass control to second factor or end with the first </div>
<div><br>
</div>
<br>
</div>
<div> </div>
<div> </div>
<div> ]]></div>
<div><br>
</div>
<div> </value></div>
<div> </constructor-arg></div>
<div> </bean></div>
<div><br>
</div>
<br>
<p></p>
<p><br>
</p>
<div id="Signature">
<div id="divtagdefaultwrapper" style="background-color: rgb(255, 255, 255); font-family: Calibri, Helvetica, sans-serif, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols, EmojiFont, "Apple Color Emoji", "Segoe UI Emoji", NotoColorEmoji, "Segoe UI Symbol", "Android Emoji", EmojiSymbols;">
<div name="divtagdefaultwrapper" style="margin:0px">
<div style="background-color:rgb(255,255,255)">
<p class="x_MsoNormal" style="color:rgb(33,33,33); font-family:'Times New Roman',serif; font-size:12pt; margin:0in 0in 0pt; background-color:rgb(255,255,255)">
<span style="color:black; font-family:Calibri,sans-serif; font-size:10.5pt">Rhian Resnick</span></p>
<p class="x_MsoNormal" style="color:rgb(33,33,33); font-family:'Times New Roman',serif; font-size:16px; margin:0in 0in 0pt; background-color:rgb(255,255,255)">
<span style="color:black; font-family:Calibri,sans-serif; font-size:10.5pt">Assistant Director Middleware and HPC</span><span style="color:black; font-family:Calibri,sans-serif; font-size:11pt"></span></p>
<p class="x_MsoNormal" style="color:rgb(33,33,33); font-family:'Times New Roman',serif; font-size:16px; margin:0in 0in 0pt; background-color:rgb(255,255,255)">
<span style="color:black; font-family:Calibri,sans-serif; font-size:10.5pt">Office of Information Technology</span></p>
<p class="x_MsoNormal" style="color:rgb(33,33,33); font-family:'Times New Roman',serif; font-size:12pt; margin:0in 0in 0pt; background-color:rgb(255,255,255)">
<span style="color:black; font-family:Calibri,sans-serif; font-size:10.5pt"><br>
</span></p>
<p class="x_MsoNormal" style="color:rgb(33,33,33); font-family:'Times New Roman',serif; font-size:12pt; margin:0in 0in 0pt; background-color:rgb(255,255,255)">
<span style="color:black; font-family:Calibri,sans-serif; font-size:10.5pt">Florida Atlantic University</span><span style="color:black; font-family:Calibri,sans-serif; font-size:11pt"></span></p>
<p class="x_MsoNormal" style="color:rgb(33,33,33); font-family:'Times New Roman',serif; font-size:12pt; margin:0in 0in 0pt; background-color:rgb(255,255,255)">
<span style="color:black; font-family:Calibri,sans-serif; font-size:10.5pt">777 Glades Road, CM22, Rm 173B</span><span style="color:black; font-family:Calibri,sans-serif; font-size:11pt"></span></p>
<p class="x_MsoNormal" style="color:rgb(33,33,33); font-family:'Times New Roman',serif; font-size:12pt; margin:0in 0in 0pt; background-color:rgb(255,255,255)">
<span style="color:black; font-family:Calibri,sans-serif; font-size:10.5pt">Boca Raton, FL 33431</span><span style="color:black; font-family:Calibri,sans-serif; font-size:11pt"></span></p>
<p class="x_MsoNormal" style="color:rgb(33,33,33); font-family:'Times New Roman',serif; font-size:12pt; margin:0in 0in 0pt; background-color:rgb(255,255,255)">
<span style="color:black; font-family:Calibri,sans-serif; font-size:10.5pt">Phone 561.297.2647</span><span style="color:black; font-family:Calibri,sans-serif; font-size:11pt"></span></p>
<p class="x_MsoNormal" style="color:rgb(33,33,33); font-family:'Times New Roman',serif; font-size:12pt; margin:0in 0in 0pt; background-color:rgb(255,255,255)">
<span style="color:black; font-family:Calibri,sans-serif; font-size:10.5pt">Fax 561.297.0222</span></p>
<p class="x_MsoNormal" style="color:rgb(33,33,33); font-family:'Times New Roman',serif; font-size:12pt; margin:0in 0in 0pt; background-color:rgb(255,255,255)">
<span style="color:black; font-family:Calibri,sans-serif; font-size:10.5pt"> </span><span style="color:rgb(31,73,125); font-family:Calibri,sans-serif; font-size:11pt"><a href="https://hpc.fau.edu/wp-content/uploads/2015/01/image.jpg" style="border:0px; font-family:Arial,Helvetica,sans-serif; font-size:13px; line-height:21px; margin:0px; padding:0px; vertical-align:baseline; color:rgb(0,102,204); text-decoration:none; background-color:rgb(239,239,239)" id="LPNoLP"><img alt="image" class="alignnone size-full wp-image-498" style="border: 0px; font-family: inherit; font-size: inherit; font-style: inherit; font-variant: inherit; font-weight: inherit; line-height: inherit; margin: 5px; padding: 0px; vertical-align: middle; max-width: 100%; width: 195px; user-select: none;" src="http://hpc.fau.edu/wp-content/uploads/2015/01/image.jpg"></a></span></p>
</div>
</div>
</div>
</div>
</div>
</body>
</html>