<div dir="ltr">It looks like this was way easier than I was making it. This seems to work<div><br></div><div><div> var logger = Java.type("org.slf4j.LoggerFactory").getLogger("net.shibboleth.idp.script.MFAflow");</div><div> nextFlow = 'authn/remoteusertoken';</div><div><br></div><div> authCtx = input.getSubcontext("net.shibboleth.idp.authn.context.AuthenticationContext");</div><div> mfaCtx = authCtx.getSubcontext("net.shibboleth.idp.authn.context.MultiFactorAuthenticationContext");</div><div><br></div><div> if (mfaCtx.isAcceptable()) {</div><div> nextFlow = null;</div><div> }</div><div><br></div><div> nextFlow;</div></div><div><br><div>I'll work on the attribute trigger later.</div></div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Dec 5, 2017 at 5:04 PM, Liam Hoekenga <span dir="ltr"><<a href="mailto:liamr@umich.edu" target="_blank">liamr@umich.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><span class=""><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote"><span class="m_2029645224110148432gmail-m_8276405838335803229m_8260270469110691902gmail-"><div>Are you just trying to trigger a flow if one of the contexts is present?<br></div></span></div></div></div></blockquote><div><br></div></span><div>Yes.</div><span class=""><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">IOW, you do Password, which should only get you Password or PPT, depending on your configuration.</div></div></div></blockquote><div><br></div></span><div>In our pre-MFA flow configuration, we had an authentication flow that invoked Duo (via external auth) if any of these contexts was requested:</div><span class=""><div> urn:oasis:names:tc:SAML:2.0:ac<wbr>:classes:TimeSyncToken</div></span><div> <a href="http://id.incommon.org/assurance/mfa" target="_blank">http://id.incommon.org/assuran<wbr>ce/mfa</a></div><div> <a href="https://refeds.org/profile/mfa" target="_blank">https://refeds.org/profile/mfa</a></div><span class=""><div><br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">Is your required logic amenable to this:</div><div class="gmail_quote"><br></div><div class="gmail_quote">mfaCtx = authCtx.getSubcontext("net.shi<wbr>bboleth.idp.authn.context.Mult<wbr>iFactorAuthenticationContext")<wbr>;<br></div><div class="gmail_quote">if (mfaCtx.isAcceptable()) { return null; } // current principals suffice</div><div class="gmail_quote">else { return nextFlow; } // run second factor</div></div></div></blockquote><div> <br></div></span><div><div>I don't yet need to trigger MFA based on a directory attribute, but will after we migrate from our legacy SSO to Shib as the primary authenticator.</div></div><div><br></div><div>What I'm starting with is a combination of Jim Fox's suggestion in <a href="http://shibboleth.net/pipermail/users/2016-December/033096.html" target="_blank">http://shibboleth.net/piper<wbr>mail/users/2016-December/03309<wbr>6.html</a>...</div><div><br></div><div><div> authCtx = input.getSubcontext("net.<wbr>shibboleth.idp.authn.context.<wbr>AuthenticationContext");</div><div> rpCtx = authCtx.getSubcontext("net.<wbr>shibboleth.idp.authn.context.<wbr>RequestedPrincipalContext");</div><span class=""><div> if (rpCtx != null) {</div><div> rps = rpCtx.getRequestedPrincipals()<wbr>;</div><div> tkp = new AuthnContextClassRefPrincipal(<wbr>"urn:oasis:names:tc:SAML:2.0:<wbr>ac:classes:TimeSyncToken");</div><div> if (rpCtx.getRequestedPrincipals(<wbr>).contains(tkp)) {</div><div> logger.debug("RP requested token login");</div><div> }</div><div> }</div></span></div><div><br></div><div>and the wiki example (<a href="https://wiki.shibboleth.net/confluence/display/IDP30/MultiFactorAuthnConfiguration#MultiFactorAuthnConfiguration-ProgrammaticallySelectingFlows" target="_blank">https://wiki.shibboleth.net/c<wbr>onfluence/display/IDP30/MultiF<wbr>actorAuthnConfiguration#MultiF<wbr>actorAuthnConfiguration-Progra<wbr>mmaticallySelectingFlows</a>).</div><div><br></div><div>How does isAcceptable() decide isAcceptable? Is it the weight map in general-authn.xml?</div><span class="HOEnZb"><font color="#888888"><div> </div><div>Liam</div></font></span></div></div></div>
</blockquote></div><br></div>