<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Hi Jeff,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
I'll let others chime in on how (or if) you can use the entityID of a particular relying party as a parameter to a query in a DataConnector. I can tell you, however, that I'm pretty sure the entityID lives in a different context — "net.shibboleth.idp.profile.context.RelyingPartyContext"
— which itself is a subcontext of the profileContext.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Given that, I think you'd use something like profileContext.getSubcontext("net.shibboleth.idp.profile.context.RelyingPartyContext").getRelyingPartyId(). Once again, I leave the wisdom of such a solution to others; it's not how we're doing it down the road.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Instead, we're resolving all the relevant attributes in a scripted context check (whether the user is eligible to use MFA, what their MFA disposition is for all relying parties, etc) and then composing the result in the script. You can find an example of a
similar approach (minus the particulars of your business rule) here: <a href="https://wiki.shibboleth.net/confluence/display/IDP30/MultiFactorAuthnConfiguration#MultiFactorAuthnConfiguration-ProgrammaticallySelectingFlows" id="LPNoLP879942">
https://wiki.shibboleth.net/confluence/display/IDP30/MultiFactorAuthnConfiguration#MultiFactorAuthnConfiguration-ProgrammaticallySelectingFlows</a></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Michael<br>
</div>
<br>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Jeff Chapin <jeff.chapin@uni.edu><br>
<b>Sent:</b> Friday, March 22, 2019 12:06 PM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> [External] Using SP Entity ID in RelationalDatabase Dataconnector</font>
<div> </div>
</div>
<div>
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">
<div dir="ltr">We are trying to implement Duo, and would like to add a 'useDuo' attribute. If this is set to 'yes', that user should use Duo, and if not, not.
<div><br>
</div>
<div>I have tried to set up a DataConnector with a RelationalDatabase to run the following:</div>
<div><br>
</div>
<div>select VARIABLE useDuo from dual;</div>
<div><br>
</div>
<div>when Variable is something like '$requestContext.getPrincipalName()' or 'resolutionContext.principal()' we successfully get the principal back, but I cannot seem to figure out how to get the SP Entity ID. I have tried things like:</div>
<div><br>
</div>
<div>$requestContext.getRelyingPartyId() and<br>
</div>
<div>$resolutionContext.attributeRecipientID()</div>
<div><br>
</div>
<div>which results in those stirngs *literally* being returned.</div>
<div><br>
</div>
<div>Ultimately, we want to query a DB and see if a given user is forced to use Duo or nor, based on business logic that is implemented and maintained in the database.</div>
<div><br>
</div>
<div><br>
</div>
<div>Thanks,</div>
<div>Jeff<br clear="all">
<div><br>
</div>
-- <br>
<div dir="ltr" class="x_gmail_signature">
<div dir="ltr">
<div>
<div dir="ltr">
<pre cols="72">Jeff Chapin,</pre>
Panther eSports Adviser <br>
Assistant Systems/Applications Administrator<br>
ITS-IS, University of Northern Iowa<br>
Phone: 319-273-3162 Email: <a href="mailto:Jeff.Chapin@uni.edu" target="_blank">Jeff.Chapin@uni.edu</a>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>