<html><body><div style="font-family: arial, helvetica, sans-serif; font-size: 10pt; color: #000000"><div>Hi,<br><br> In my browser the mail has a bit challenging formatting so I may be bit off with these answers.<br><br> First make sure that you have set oidc specific authentication method principals as described in https://github.com/CSCfi/shibboleth-idp-oidc-extension/wiki/AuthenticationConfiguration.<br><br> >>if there is acr value set in the request, there is no way of defining it to be essential.<br><br>See https://openid.net/specs/openid-connect-core-1_0.html#IndividualClaimsRequests and https://openid.net/specs/openid-connect-core-1_0.html#acrSemantics on how to request acr claim as essential claim in the request and the difference between how essential and voluntary acr claim request should be handled by OP. If you request the acr value as essential the extension will behave like you would expect after SAML2 world i.e. the requirement must be met or error is returned. For voluntary acr claims request the extension should select the requested flow if possible, otherwise it should fall back to some other flow not satisfying the acr in the request. If it is not behaving like that there is either a misconfiguration or bug in the implementation. If you suspect the latter, please send me the authentication configuration you have and I will have a look.<br> <br><br>Br Janne<br><br></div><div><br></div><hr id="zwchr" data-marker="__DIVIDER__"><div data-marker="__HEADERS__"><b>From: </b>"Esa Nuutinen" <esa.nuutinen@finnsokung.fi><br><b>To: </b>"users" <users@shibboleth.net><br><b>Sent: </b>Monday, 31 December, 2018 14:20:36<br><b>Subject: </b>GEANT OIDC plugin - using ACR value for choosing authentication flow<br></div><div><br></div><div data-marker="__QUOTED_TEXT__">Hi.
I would need to implement two different authentication flows based on acr value in the OIDC request (one is for testing and one is for actually doing sensible authentication).
Based on logs it seems that it receives the value just fine:
2018-12-31 11:06:26,430 - DEBUG [org.geant.idpextension.oidc.profile.impl.ProcessRequestedAuthnContext:153] - Profile Action ProcessRequestedAuthnContext: Located acr value http://test3 in request
2018-12-31 11:06:26,430 - DEBUG [org.geant.idpextension.oidc.profile.impl.ProcessRequestedAuthnContext:184] - Profile Action ProcessRequestedAuthnContext: Created preferred principal context
2018-12-31 11:06:26,792 - DEBUG [net.shibboleth.idp.authn.impl.PopulateAuthenticationContext:221] - Profile Action PopulateAuthenticationContext: Installed 1 potential authentication flows into AuthenticationContext
2018-12-31 11:06:26,873 - DEBUG [net.shibboleth.idp.authn.impl.InitializeRequestedPrincipalContext:152] - Profile Action InitializeRequestedPrincipalContext: Profile configuration did not supply any default authentication methods
2018-12-31 11:06:26,900 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByForcedAuthn:53] - Profile Action FilterFlowsByForcedAuthn: Request does not have forced authentication requirement, nothing to do
2018-12-31 11:06:26,921 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByNonBrowserSupport:53] - Profile Action FilterFlowsByNonBrowserSupport: Request does not have non-browser requirement, nothing to do
2018-12-31 11:06:26,941 - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:264] - Profile Action SelectAuthenticationFlow: No specific Principals requested
2018-12-31 11:06:26,942 - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:309] - Profile Action SelectAuthenticationFlow: No usable active results available, selecting an inactive flow
2018-12-31 11:06:26,943 - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:363] - Profile Action SelectAuthenticationFlow: Selecting inactive authentication flow authn/prod
But it doesn't seem to be using it for SelectingAuthenticationFlow. If I look the code, if acr has values:
idp-oidc-extension-impl/src/main/java/org/geant/idpextension/oidc/profile/impl/ ProcessRequestedAuthnContext.java
<b>if (acrValues != null && !acrValues.isEmpty()) {
for (ACR acr : acrValues) {
log.debug("{} Located acr value {} in request", getLogPrefix(), acr.getValue());
principals.add(new AuthenticationContextClassReferencePrincipal(acr.getValue()));
}
}</b> else if (acrClaim != null && acrClaim.getValue() != null) {
isEssential = acrClaim.getClaimRequirement().equals(ClaimRequirement.ESSENTIAL);
log.debug("{} Located {} acr claim {} in id token of request", getLogPrefix(),
acrClaim.getClaimRequirement().toString(), acrClaim.getValue());
principals.add(new AuthenticationContextClassReferencePrincipal(acrClaim.getValue()));
} else if (acrClaim != null && !(acrClaim.getValues() != null && acrClaim.getValues().isEmpty())) {
isEssential = acrClaim.getClaimRequirement().equals(ClaimRequirement.ESSENTIAL);
for (String acr : acrClaim.getValues()) {
log.debug("{} Located {} acr claim {} in id token of request", getLogPrefix(),
acrClaim.getClaimRequirement().toString(), acr);
principals.add(new AuthenticationContextClassReferencePrincipal(acr));
}
}
if (principals.isEmpty()) {
log.debug("{} request did not contain any acr values, nothing to do", getLogPrefix());
return;
}
But then isEssential is always false, becaue acr had some value defined:
if (isEssential) {
final RequestedPrincipalContext rpCtx = new RequestedPrincipalContext();
rpCtx.setOperator(AuthnContextComparisonTypeEnumeration.EXACT.toString());
rpCtx.setRequestedPrincipals(principals);
authenticationContext.addSubcontext(rpCtx, true);
log.debug("{} Created requested principal context", getLogPrefix());
return;
}
And then after that it is setting it just as PreferredPrincipalContext:
final PreferredPrincipalContext ppCtx = new PreferredPrincipalContext();
ppCtx.setPreferredPrincipals(principals);
authenticationContext.addSubcontext(ppCtx, true);
Which I guess then by passes the selection process of the flow, as it is just Preferred and not Requested, and as far as I see in the code, if there is acr value set in the request, there is no way of defining it to be essential...
Is there some other way that I could use acr value to choose the right authentication flow out of two possible... ? Or how this is supposed to work with Geant OIDC plugin? Technically for my use case this is easy to fix by chancing isEssential to be true by default and I think it will work for me, but is there some generic way how I could get choosing authentication flow working with Geant OIDC plugin or is this just some bug in the code/unimplemented feature.
Or am I missing something else in the configuration related to this, so that preferred principals would impact choosing the right authentication flow?
This is 0.8 version of plugin few months back that I'm using, so not quite the latest from Geant OIDC git repository, because few other changes have been required for this project too in order it to work for this project so I'm not sure now if this part has been somehow modified already, but at least above class haven't been changed since I pulled the code there...
// Esa
<br><hr width="300" align="left">
Sent from the <a href="http://shibboleth.1660669.n2.nabble.com/Shibboleth-Users-f1660767.html" target="_blank">Shibboleth - Users mailing list archive</a> at Nabble.com.<br><br>-- <br>For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg<br>To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br></div></div></body></html>