<div dir="ltr">Hi Scott,<br><br>I am passing the c14n definition, but I'm stuck and decided to ask for help.<br><br>Also, I was trying to understand how this works for the view scope, but not when I passed it to the setter.<br><set name="viewScope.canonicalUsername" value="CanonicalUsernameStrategy.apply(opensamlProfileRequestContext)" /><br><br>-- $IDP_HOME/flows/authn/Radius/radius-authn-beans.xml<br><?xml version="1.0" encoding="UTF-8"?><br><beans xmlns="<a href="http://www.springframework.org/schema/beans">http://www.springframework.org/schema/beans</a>" xmlns:context="<a href="http://www.springframework.org/schema/context">http://www.springframework.org/schema/context</a>"<br> xmlns:util="<a href="http://www.springframework.org/schema/util">http://www.springframework.org/schema/util</a>" xmlns:p="<a href="http://www.springframework.org/schema/p">http://www.springframework.org/schema/p</a>" xmlns:c="<a href="http://www.springframework.org/schema/c">http://www.springframework.org/schema/c</a>"<br> xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>"<br> xsi:schemaLocation="<a href="http://www.springframework.org/schema/beans">http://www.springframework.org/schema/beans</a> <a href="http://www.springframework.org/schema/beans/spring-beans.xsd">http://www.springframework.org/schema/beans/spring-beans.xsd</a><br> <a href="http://www.springframework.org/schema/context">http://www.springframework.org/schema/context</a> <a href="http://www.springframework.org/schema/context/spring-context.xsd">http://www.springframework.org/schema/context/spring-context.xsd</a><br> <a href="http://www.springframework.org/schema/util">http://www.springframework.org/schema/util</a> <a href="http://www.springframework.org/schema/util/spring-util.xsd">http://www.springframework.org/schema/util/spring-util.xsd</a>"<br><br> default-init-method="initialize" default-destroy-method="destroy"><br><br> <bean class="org.springframework.context.support.PropertySourcesPlaceholderConfigurer" p:placeholderPrefix="%{"<br> p:placeholderSuffix="}" /><br><br> <bean class="net.shibboleth.ext.spring.config.IdentifiableBeanPostProcessor" /><br> <bean class="net.shibboleth.idp.profile.impl.ProfileActionBeanPostProcessor" /><br><br> <!-- Default static integration. --><br> <bean id="shibboleth.authn.radius.RadiusIntegration" class="net.shibboleth.idp.authn.radius.RadiusShibboleth"<br> p:radiusSecret="%{radius.secret:#{null}}"<br> p:radiusHost="%{radius.host:#{null}}"<br> p:radiusPort="%{radius.port:#{null}}" /><br><br> <bean id="shibboleth.authn.radius.RadiusIntegrationStrategy" class="com.google.common.base.Functions"<br> factory-method="constant" c:_0-ref="shibboleth.authn.radius.RadiusIntegration" /><br><br> <!-- Default username comes from previous c14n or session. --><br> <bean id="shibboleth.authn.radius.UsernameLookupStrategy"<br> class="net.shibboleth.idp.session.context.navigate.CanonicalUsernameLookupStrategy" /><br><br> <alias name="shibboleth.authn.radius.UsernameLookupStrategy" alias="CanonicalUsernameStrategy" /><br><br> <bean id="shibboleth.HttpServletRequestSupplier"<br> class="net.shibboleth.shared.servlet.impl.ThreadLocalHttpServletRequestSupplier" /><br><br> <bean id="RadiusWebResponse" scope="prototype"<br> class="net.shibboleth.idp.authn.radius.RadiusWebResponse"<br> p:usernameLookupStrategy-ref="shibboleth.authn.radius.UsernameLookupStrategy"<br> p:request="HAMBURGER" /><br></beans><br><br>-- $IDP_HOME/flows/authn/Radius/radius-authn-flow.xml<br><flow xmlns="<a href="http://www.springframework.org/schema/webflow">http://www.springframework.org/schema/webflow</a>" xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>"<br> xsi:schemaLocation="<a href="http://www.springframework.org/schema/webflow">http://www.springframework.org/schema/webflow</a> <a href="http://www.springframework.org/schema/webflow/spring-webflow.xsd">http://www.springframework.org/schema/webflow/spring-webflow.xsd</a>"<br> parent="authn.abstract"><br><br> <view-state id="DisplayRadiusWebView" view="radius"><br> <on-render><br> <evaluate expression="environment" result="viewScope.environment" /><br> <evaluate expression="opensamlProfileRequestContext" result="viewScope.profileRequestContext" /><br> <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext))" result="viewScope.authenticationContext" /><br> <evaluate expression="authenticationContext.getSubcontext(T(net.shibboleth.idp.ui.context.RelyingPartyUIContext))" result="viewScope.rpUIContext" /><br> <evaluate expression="T(net.shibboleth.utilities.java.support.codec.HTMLEncoder)" result="viewScope.encoder" /><br> <evaluate expression="flowRequestContext.getExternalContext().getNativeRequest()" result="viewScope.request" /><br> <evaluate expression="flowRequestContext.getExternalContext().getNativeResponse()" result="viewScope.response" /><br> <evaluate expression="flowRequestContext.getActiveFlow().getApplicationContext().containsBean('shibboleth.CustomViewContext') ?<br> flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.CustomViewContext') : null" result="viewScope.custom" /><br><br> <set name="viewScope.RadiusIntegration" value="flowRequestContext.getActiveFlow().getApplicationContext().getBean('shibboleth.authn.radius.RadiusIntegrationStrategy').apply(opensamlProfileRequestContext)" /><br> <set name="viewScope.canonicalUsername" value="CanonicalUsernameStrategy.apply(opensamlProfileRequestContext)" /><br> <set name="viewScope.radiusSecret" value="RadiusIntegration.getRadiusSecret()" /><br> <set name="viewScope.radiusHost" value="RadiusIntegration.getRadiusHost()" /><br> <set name="viewScope.radiusPort" value="RadiusIntegration.getRadiusPort()" /><br><br> <set name="viewScope.radiusScriptPath" value="'/js/radius.js'" /><br> </on-render><br><br> <transition on="proceed" to="RadiusWebResponse" /><br> <!--transition on="proceed" to="proceed" /--><br> <transition on="cancel" to="ReselectFlow" /><br> </view-state><br><br> <action-state id="RadiusWebResponse"><br> <evaluate expression="RadiusWebResponse" /><br> <evaluate expression="'proceed'" /><br> <transition on="proceed" to="proceed" /><br> <transition to="DisplayRadiusWebView" /><br> </action-state><br><br> <bean-import resource="radius-authn-beans.xml" /><br></flow><br><br>-- RadiusWebResponse.java<br>package net.shibboleth.idp.authn.radius;<br><br>import org.slf4j.Logger;<br>import org.slf4j.LoggerFactory;<br>import javax.servlet.http.HttpServletRequest;<br><br>public class RadiusWebResponse {<br> private final Logger log = LoggerFactory.getLogger(RadiusWebResponse.class);<br><br> private String request;<br> private String username;<br><br> public void setRequest(String request) {<br> <a href="http://log.info">log.info</a>("SET STRING: " + request);<br> this.request = request;<br> }<br><br> public void setUsernameLookupStrategy(java.util.function.Function<org.opensaml.profile.context.ProfileRequestContext, java.lang.String> strategy) {<br> username = net.shibboleth.idp.session.context.navigate.CanonicalUsernameLookupStrategy.apply(strategy);<br> <a href="http://log.info">log.info</a>("SET STRING: " + strategy);<br> }<br>}<br><br>-- $IDP_HOME/logs/idp-process.log<br>2024-06-06 02:20:29,709 - 127.0.0.1 - INFO [net.shibboleth.idp.authn.radius.RadiusWebResponse:20] - SET STRING: HAMBURGER<br>2024-06-06 02:20:29,709 - 127.0.0.1 - INFO [net.shibboleth.idp.authn.radius.RadiusWebResponse:35] - SET STRING: net.shibboleth.idp.session.context.navigate.CanonicalUsernameLookupStrategy@12114497<br><br>Thanks,<br>-Jeff<br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Thu, Jun 6, 2024 at 9:16 AM Cantor, Scott <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">> The username reference is just my thing but what I’m trying<br>
> to get is the id the user used in the auth/Password view. I am<br>
> able to produce it in my own view.<br>
<br>
There is no (reliable) way to get the value from that view/form specifically, only the value that's passed through the Password flow's subject c14n step and comes out at the end. Anything else would require being inside the Password flow itself. The intermediate data is essentially just working state.<br>
<br>
The most "typical" method used from inside the MFA flow to get that value is the one we default to for getting the name to pass along to Duo (or any other second factor service really), and that is, yes, the net.shibboleth.idp.session.context.navigate.CanonicalUsernameLookupStrategy function class.<br>
<br>
That's an API class and is ok to use, so manufacturing an instance of that (or wiring one up as a Spring bean) is probably what you want. You don't pass a function to it, you pass the ProfileRequestContext object into it as the input to apply().<br>
<br>
What that actually does is check for a SubjectCanonicalizationContext in the tree and the name inside it that presumably came from a previous factor (Password usually) and if it can't find that, it checks for a SessionContext that indicates a SSO session exists and pulls a name out of there. The latter is what allows step up to work.<br>
<br>
Point being that while that function is definitely ok to use, it does a specific thing that isn't necessarily the thing desired in every custom use case.<br>
<br>
-- Scott<br>
<br>
<br>
</blockquote></div>