<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
It's your choice as to where you'd rather define the business logic. Based on Scott's response, you should be able to get at the entityID in the QueryTemplate, in which case you can still use it as a query parameter per your initial approach.<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
What I meant to say is that as opposed to defining MFA business logic in an external database, we found it more elegant to keep the logic defined in the IdP itself, and to just use our DB connections as raw attribute repositories.<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
If you do choose to shift the business logic into Shibboleth itself, I wasn't suggesting running the DB query from Nashorn (I'm not even sure what that would look like, besides some sort of hybrid scripted/RDBMS data connector). Instead, I meant that we were
using the results of attributes (resolved through our standard RDBMS DataConnectors) in a script defined in mfa-authn-config.xml to make our MFA decisions.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Michael<br>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Jeff Chapin <jeff.chapin@uni.edu><br>
<b>Sent:</b> Friday, March 22, 2019 1:03 PM<br>
<b>To:</b> Domingues, Michael D<br>
<b>Cc:</b> Shib Users<br>
<b>Subject:</b> Re: [External] Using SP Entity ID in RelationalDatabase Dataconnector</font>
<div> </div>
</div>
<div>
<div dir="ltr">
<div dir="ltr">profileContext.getSubcontext("net.shibboleth.idp.profile.context.RelyingPartyContext").getRelyingPartyId(). returned as a literal (with and without the "()" -- that has not seemed to change the behavior yet).<br>
</div>
<div dir="ltr"><br>
</div>
<div>I am looking at how to run a DB query in nashhorn now.</div>
<div><br>
</div>
<div>Jeff</div>
</div>
<br>
<div class="x_gmail_quote">
<div dir="ltr" class="x_gmail_attr">On Fri, Mar 22, 2019 at 12:55 PM Jeff Chapin <<a href="mailto:jeff.chapin@uni.edu">jeff.chapin@uni.edu</a>> wrote:<br>
</div>
<blockquote class="x_gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left:1px solid rgb(204,204,204); padding-left:1ex">
<div dir="ltr">Micheal,
<div><br>
</div>
<div>I had looked at that page previously, and had thought that using a dataconnector to run the query seemed easier than writing script that can independently run a query seemed more straight forward.</div>
<div><br>
</div>
<div>I can certainly go that route, though.</div>
</div>
<br>
<div class="x_gmail_quote">
<div dir="ltr" class="x_gmail_attr">On Fri, Mar 22, 2019 at 12:30 PM Domingues, Michael D <<a href="mailto:michael-domingues@uiowa.edu" target="_blank">michael-domingues@uiowa.edu</a>> wrote:<br>
</div>
<blockquote class="x_gmail_quote" style="margin:0px 0px 0px 0.8ex; border-left:1px solid rgb(204,204,204); padding-left:1ex">
<div dir="ltr">
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
Hi Jeff,</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
I'll let others chime in on how (or if) you can use the entityID of a particular relying party as a parameter to a query in a DataConnector. I can tell you, however, that I'm pretty sure the entityID lives in a different context — "net.shibboleth.idp.profile.context.RelyingPartyContext"
— which itself is a subcontext of the profileContext.</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
Given that, I think you'd use something like profileContext.getSubcontext("net.shibboleth.idp.profile.context.RelyingPartyContext").getRelyingPartyId(). Once again, I leave the wisdom of such a solution to others; it's not how we're doing it down the road.</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
Instead, we're resolving all the relevant attributes in a scripted context check (whether the user is eligible to use MFA, what their MFA disposition is for all relying parties, etc) and then composing the result in the script. You can find an example of a
similar approach (minus the particulars of your business rule) here: <a href="https://wiki.shibboleth.net/confluence/display/IDP30/MultiFactorAuthnConfiguration#MultiFactorAuthnConfiguration-ProgrammaticallySelectingFlows" id="x_gmail-m_4113225048348054275gmail-m_-5185854505101228637LPNoLP879942" target="_blank">
https://wiki.shibboleth.net/confluence/display/IDP30/MultiFactorAuthnConfiguration#MultiFactorAuthnConfiguration-ProgrammaticallySelectingFlows</a></div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:11pt; color:rgb(0,0,0)">
Michael<br>
</div>
<br>
<div id="x_gmail-m_4113225048348054275gmail-m_-5185854505101228637appendonsend"></div>
<hr style="display:inline-block; width:98%">
<div id="x_gmail-m_4113225048348054275gmail-m_-5185854505101228637divRplyFwdMsg" dir="ltr">
<font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> users <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a>> on behalf of Jeff Chapin <<a href="mailto:jeff.chapin@uni.edu" target="_blank">jeff.chapin@uni.edu</a>><br>
<b>Sent:</b> Friday, March 22, 2019 12:06 PM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> [External] Using SP Entity ID in RelationalDatabase Dataconnector</font>
<div> </div>
</div>
<div>
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">We are trying to implement Duo, and would like to add a 'useDuo' attribute. If this is set to 'yes', that user should use Duo, and if not, not.
<div><br>
</div>
<div>I have tried to set up a DataConnector with a RelationalDatabase to run the following:</div>
<div><br>
</div>
<div>select VARIABLE useDuo from dual;</div>
<div><br>
</div>
<div>when Variable is something like '$requestContext.getPrincipalName()' or 'resolutionContext.principal()' we successfully get the principal back, but I cannot seem to figure out how to get the SP Entity ID. I have tried things like:</div>
<div><br>
</div>
<div>$requestContext.getRelyingPartyId() and<br>
</div>
<div>$resolutionContext.attributeRecipientID()</div>
<div><br>
</div>
<div>which results in those stirngs *literally* being returned.</div>
<div><br>
</div>
<div>Ultimately, we want to query a DB and see if a given user is forced to use Duo or nor, based on business logic that is implemented and maintained in the database.</div>
<div><br>
</div>
<div><br>
</div>
<div>Thanks,</div>
<div>Jeff<br clear="all">
<div><br>
</div>
-- <br>
<div dir="ltr" class="x_gmail-m_4113225048348054275gmail-m_-5185854505101228637x_gmail_signature">
<div dir="ltr">
<div>
<div dir="ltr">
<pre cols="72">Jeff Chapin,</pre>
Panther eSports Adviser <br>
Assistant Systems/Applications Administrator<br>
ITS-IS, University of Northern Iowa<br>
Phone: 319-273-3162 Email: <a href="mailto:Jeff.Chapin@uni.edu" target="_blank">Jeff.Chapin@uni.edu</a>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<br clear="all">
<div><br>
</div>
-- <br>
<div dir="ltr" class="x_gmail-m_4113225048348054275gmail_signature">
<div dir="ltr">
<div>
<div dir="ltr">
<pre cols="72">Jeff Chapin,</pre>
Panther eSports Adviser <br>
Assistant Systems/Applications Administrator<br>
ITS-IS, University of Northern Iowa<br>
Phone: 319-273-3162 Email: <a href="mailto:Jeff.Chapin@uni.edu" target="_blank">Jeff.Chapin@uni.edu</a>
</div>
</div>
</div>
</div>
</blockquote>
</div>
<br clear="all">
<div><br>
</div>
-- <br>
<div dir="ltr" class="x_gmail_signature">
<div dir="ltr">
<div>
<div dir="ltr">
<pre cols="72">Jeff Chapin,</pre>
Panther eSports Adviser <br>
Assistant Systems/Applications Administrator<br>
ITS-IS, University of Northern Iowa<br>
Phone: 319-273-3162 Email: <a href="mailto:Jeff.Chapin@uni.edu" target="_blank">Jeff.Chapin@uni.edu</a>
</div>
</div>
</div>
</div>
</div>
</body>
</html>