<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></b></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Firstly, MFA is intended to be scripted only when the default transitions that you specify don’t apply… in other words, you don’t have to make a scripted strategy for authn/Password
if that will always be your first factor of authentication; which looks to be the case considering your downstream strategy needs a username.<o:p></o:p></span></b></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></b></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">Secondly, a strategy that decides what the next flow should be should never touch the AuthnticationResult. By replacing the authnResult, you are zapping the c14n that the
password flow has already done. That is likely the surface cause of your error. The root cause is likely that your authn/MFA config (in conf/authn/general-authn.xml) doesn’t support the principal(s) that end up in your new authnResult<o:p></o:p></span></b></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></b></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">-Josh<o:p></o:p></span></b></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><o:p> </o:p></span></b></p>
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> users [mailto:users-bounces@shibboleth.net]
<b>On Behalf Of </b>Noriyuki TAKEI<br>
<b>Sent:</b> Tuesday, May 15, 2018 9:26 AM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Omit flow by value defined in attribute-resolver.xml<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Hi,all.<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I’m using MFA that consists of two flows(auth/Password and authn/Totp).<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">authn/Totp is new flow I have uniquely developed.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I would like to omit authn/Totp flow by value defined in attribute-resolver.xml<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">For example,when totpFlg defined in attribute-resolver.xml is 1,omitting authn/Totp Flow.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">In order to achieve this,I defined as below in mfa-authn-config.xml.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal"><util:map id="shibboleth.authn.MFA.TransitionMap"><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <entry key=""><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <bean parent="shibboleth.authn.MFA.Transition" p:nextFlowStrategy-ref="checkPasswordFlow" /><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> </entry><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"> <entry key="authn/Password"><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <bean parent="shibboleth.authn.MFA.Transition" p:nextFlowStrategy-ref="checkTotpFlow" /><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> </entry><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"> <!-- An implicit final rule will return whatever the second flow returns. --><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"></util:map><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><bean id="checkPasswordFlow" parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript"<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> p:customObject-ref="shibboleth.AttributeResolverService"><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> ...omit...<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"></bean><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><bean id="checkTotpFlow" parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript"<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> p:customObject-ref="shibboleth.AttributeResolverService"><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <constructor-arg><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <value><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <![CDATA[<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> nextFlow = "authn/Totp";<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> resCtx = input.getSubcontext(<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> "net.shibboleth.idp.attribute.resolver.context.AttributeResolutionContext", true);<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"> usernameLookupStrategyClass = Java.type("net.shibboleth.idp.session.context.navigate.CanonicalUsernameLookupStrategy");<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> usernameLookupStrategy = new usernameLookupStrategyClass();<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> resCtx.setPrincipal(usernameLookupStrategy.apply(input));<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"> resCtx.getRequestedIdPAttributeNames().add("totpFlg");<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> resCtx.resolveAttributes(custom);<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> attribute = resCtx.getResolvedIdPAttributes().get("totpFlg");<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> valueType = Java.type("net.shibboleth.idp.attribute.StringAttributeValue");<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> if (attribute != null && attribute.getValues().contains(new valueType("1"))) {<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> authCtx = input.getSubcontext("net.shibboleth.idp.authn.context.AuthenticationContext");<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> authResult = Java.type("net.shibboleth.idp.authn.AuthenticationResult");<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> subject = input.getSubcontext("net.shibboleth.idp.authn.context.SubjectCanonicalizationContext").getSubject();<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> authCtx.setAuthenticationResult( new authResult("authn/Totp",subject));<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> nextFlow = null;<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> }<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> nextFlow;<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> ]]><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> </value><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"> </constructor-arg><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"></bean><o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">But,error as below occurred in idp-warn.log and I can not access the SP.<o:p></o:p></p>
</div>
<p class="MsoNormal"><br>
2018-05-15 23:22:27,140 - WARN [net.shibboleth.idp.authn.impl.FinalizeAuthentication:179] - Profile Action FinalizeAuthentication: Authentication result for flow authn/MFA did not satisfy the request<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I guess that AuthenticationResult is not set correcctly.<o:p></o:p></p>
<div>
<p class="MsoNormal"><br>
Does someone may give a hint?<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</div>
</div>
</div>
</body>
</html>