<div dir="ltr">Hi,all.<div><br></div><div>I’m using MFA that consists of two flows(auth/Password and authn/Totp).</div><div><br></div><div>authn/Totp is new flow I have uniquely developed.</div><div><br></div><div>I would like to omit authn/Totp flow by value defined in attribute-resolver.xml</div><div><br></div><div>For example,when totpFlg defined in attribute-resolver.xml is 1,omitting authn/Totp Flow.</div><div><br></div><div>In order to achieve this,I defined as below in mfa-authn-config.xml.</div><div><br></div><div><br></div><div><div><util:map id="shibboleth.authn.MFA.TransitionMap"></div><div>    <entry key=""></div><div>        <bean parent="shibboleth.authn.MFA.Transition" p:nextFlowStrategy-ref="checkPasswordFlow" /></div><div>    </entry></div><div><br></div><div>    <entry key="authn/Password"></div><div>        <bean parent="shibboleth.authn.MFA.Transition" p:nextFlowStrategy-ref="checkTotpFlow" /></div><div>    </entry></div><div><br></div><div>    <!-- An implicit final rule will return whatever the second flow returns. --></div><div></util:map></div><div><br></div><div><bean id="checkPasswordFlow" parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript"</div><div>    p:customObject-ref="shibboleth.AttributeResolverService"></div><div>   ...omit...</div><div></bean></div><div><br></div><div><bean id="checkTotpFlow" parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript"</div><div>    p:customObject-ref="shibboleth.AttributeResolverService"></div><div>    <constructor-arg></div><div>        <value></div><div>        <![CDATA[</div><div>            nextFlow = "authn/Totp";</div><div>            </div><div>            resCtx = input.getSubcontext(</div><div>                "net.shibboleth.idp.attribute.resolver.context.AttributeResolutionContext", true);</div><div><br></div><div>            usernameLookupStrategyClass = Java.type("net.shibboleth.idp.session.context.navigate.CanonicalUsernameLookupStrategy");</div><div>            usernameLookupStrategy = new usernameLookupStrategyClass();</div><div>            resCtx.setPrincipal(usernameLookupStrategy.apply(input));</div><div><br></div><div>            resCtx.getRequestedIdPAttributeNames().add("totpFlg");</div><div>            resCtx.resolveAttributes(custom);</div><div>            attribute = resCtx.getResolvedIdPAttributes().get("totpFlg");</div><div>            valueType =  Java.type("net.shibboleth.idp.attribute.StringAttributeValue");</div><div>            if (attribute != null && attribute.getValues().contains(new valueType("1"))) {</div><div>                authCtx = input.getSubcontext("net.shibboleth.idp.authn.context.AuthenticationContext");</div><div>                authResult = Java.type("net.shibboleth.idp.authn.AuthenticationResult");</div><div>                subject = input.getSubcontext("net.shibboleth.idp.authn.context.SubjectCanonicalizationContext").getSubject();</div><div>                authCtx.setAuthenticationResult( new authResult("authn/Totp",subject));</div><div>                nextFlow = null;</div><div>            }</div><div>            nextFlow;</div><div>        ]]></div><div>        </value></div><div>    </constructor-arg></div><div></bean></div></div><div><br></div><div>But,error as below occurred in idp-warn.log and I can not access the SP.</div><br>2018-05-15 23:22:27,140 - WARN [net.shibboleth.idp.authn.impl.FinalizeAuthentication:179] - Profile Action FinalizeAuthentication: Authentication result for flow authn/MFA did not satisfy the request<div><br></div><div>I guess that AuthenticationResult is not set correcctly.<br><div><br>Does someone may give a hint?<div><br></div></div></div></div>