<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">On 2/1/2024 7:34 AM, Cantor, Scott
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:28BFE0AF-52AD-4AFB-8BBB-FA29AC82DC50@osu.edu">
<pre><blockquote type="cite" style="color: #007cff;"><pre
class="moz-quote-pre" wrap="">It looks like I can dig into the object "manually" (since I can fairly
confidently assume that the values are all StringAttributeValues in this
case) but is there a better way to do "is attribute value X among the
attribute values for attribute Y"?
</pre></blockquote><pre class="moz-quote-pre" wrap="">Not in that old a version, but the overall approach is also not ideal. I'd wire up a SimpleAttributePredicate bean and just apply it to the data.</pre></pre>
</blockquote>
<p>Thanks for the tip - this seems to do the trick (I'm guessing it
could be simplified a bit tho), as long as the SP does not ask for
a specific AuthnContext (my weight map makes the IdP prefer to
send our umn-URL over REFEDS). If asked for a specific context,
the IdP throws a NoAuthnContext error and logs indicate that none
of the authn flows matched. In authn.properties I have:<br>
<br>
<font face="monospace">idp.authn.SAML.supportedPrincipals = \<br>
urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport,
\<br>
urn:oasis:names:tc:SAML:2.0:ac:classes:Password, \<br>
<a class="moz-txt-link-freetext" href="https://www.umn.edu/shibboleth/classes/authncontext/duo">https://www.umn.edu/shibboleth/classes/authncontext/duo</a>, \<br>
<a class="moz-txt-link-freetext" href="https://refeds.org/profile/mfa">https://refeds.org/profile/mfa</a></font><br>
</p>
<p>which I thought would be sufficient. The
shibboleth.AvailableAuthenticationFlows list in general-authn.xml
is commented out, so it should be using the default flow
descriptor for authn/SAML, which should be interpolating the above
property, so I'm confused as to its refusal.</p>
<p>In relying-party.xml:<br>
</p>
<p><font face="monospace"> <bean id="SAML2.SSO-NGWA"
parent="SAML2.SSO"<br>
p:inboundInterceptorFlows="#{{'security-policy/saml2-sso','noguestwifiauth'}}"<br>
p:skipEndpointValidationWhenSigned="true"<br>
p:postAuthenticationFlows="expiredpw"><br>
<property name="authnContextTranslationStrategyEx"><br>
<bean parent="shibboleth.Functions.Scripted"
factory-method="inlineScript"<br>
p:inputType="org.opensaml.profile.context.ProfileRequestContext"<br>
p:outputType="java.util.Collection"><br>
<property name="customObject"><br>
<bean
class="net.shibboleth.idp.profile.logic.SimpleAttributePredicate"><br>
<property name="attributeValueMap"><br>
<map><br>
<entry key="amr"><br>
<list><value>mfa</value></list><br>
</entry><br>
</map><br>
</property><br>
<!-- idp 4.2.0 gets the embedded
profileRequestContext so<br>
need to remove some of the Composes or
redo with newer access beans --><br>
<property
name="attributeContextLookupStrategy"><br>
<bean
parent="shibboleth.Functions.Compose"<br>
c:g-ref="shibboleth.ChildLookup.AttributeContext"><br>
<constructor-arg name="f"><br>
<bean
parent="shibboleth.Functions.Compose"<br>
c:g-ref="shibboleth.ChildLookup.RelyingParty"><br>
<constructor-arg
name="f"><br>
<bean
parent="shibboleth.Functions.Compose"<br>
c:g-ref="shibboleth.ChildLookup.ProfileRequestContext"<br>
c:f-ref="shibboleth.ChildLookup.AuthenticationContext" /><br>
</constructor-arg><br>
</bean><br>
</constructor-arg><br>
</bean><br>
</property><br>
</bean><br>
</property><br>
<br>
<constructor-arg><br>
<value><br>
<![CDATA[<br>
logger =
Java.type("org.slf4j.LoggerFactory").getLogger("net.shibboleth.idp.attribute.resolver.amr");<br>
var Principal =
Java.type("net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal");<br>
var ArrayList =
Java.type("java.util.ArrayList");<br>
<br>
var hasMFA = custom.test(input);<br>
logger.debug("Check if amr attribute contains
mfa: {}", hasMFA);<br>
result = new ArrayList();<br>
<br>
if (hasMFA) {<br>
result.add(new
Principal(<a class="moz-txt-link-rfc2396E" href="https://refeds.org/profile/mfa">"https://refeds.org/profile/mfa"</a>));<br>
result.add(new
Principal(<a class="moz-txt-link-rfc2396E" href="https://www.umn.edu/shibboleth/classes/authncontext/duo">"https://www.umn.edu/shibboleth/classes/authncontext/duo"</a>));<br>
} else {<br>
result.add(new
Principal("urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"));<br>
}<br>
result;<br>
]]><br>
</value><br>
</constructor-arg><br>
</bean><br>
</property><br>
</bean><br>
</font><br>
</p>
<pre class="moz-signature" cols="72">--
%% Christopher A. Bongaarts %% <a class="moz-txt-link-abbreviated" href="mailto:cab@umn.edu">cab@umn.edu</a> %%
%% OIT - Identity Management %% <a class="moz-txt-link-freetext" href="http://umn.edu/~cab">http://umn.edu/~cab</a> %%
%% University of Minnesota %% +1 (612) 625-1809 %%
</pre>
</body>
</html>