<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hi Devin,</p>
<p>alternatively, you can use my fudiscr plugin, which solves this
problem:<br>
<a class="moz-txt-link-freetext" href="https://doku.tid.dfn.de/en:shibidp:plugin-fudiscr">https://doku.tid.dfn.de/en:shibidp:plugin-fudiscr</a><br>
<br>
There are several variants for adding the realm/domain to the
request to the backend. If you only need one realm for the
configuration with privacyIDEA, it is sufficient to set the
parameter<br>
fudiscr.privacyidea.default_realm=<your realm><br>
<br>
You should also set at least the following parameters after
installation:<br>
fudiscr.challengeResponseClient=PrivacyIdeaChallengeResponseClient<br>
fudiscr.privacyidea.base_uri=<uri to privacyIDEA API><br>
fudiscr.privacyidea.authorization_token=<generated token with
pi-manage><br>
</p>
<div class="moz-cite-prefix">BR,</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">Steffen</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">Am 11.07.25 um 21:38 schrieb Devin
Ridge via users:<br>
</div>
<blockquote type="cite"
cite="mid:50E45A45-080F-49E9-B897-FC593E1B56EA@globalnoc.iu.edu">
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<meta name="Generator"
content="Microsoft Word 15 (filtered medium)">
<style>@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;
mso-ligatures:standardcontextual;}a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:windowtext;}.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}div.WordSection1
{page:WordSection1;}</style>
<div class="WordSection1">
<p class="MsoNormal"><span style="color:black">Hey all,<o:p></o:p></span></p>
<p class="MsoNormal"
style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-stroke-width: 0px;word-spacing:0px"><span
style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"
style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-stroke-width: 0px;word-spacing:0px"><span
style="color:black">I’m trying to append a domain to uid,
temporarily, for an authentication module in MFA flow. The
first step is authn/Password with user credentials and the
the next step is authn/privacyIDEA via a module. The issue
is that uid, which we rely on in many places to not be
scoped, needs to be scoped for the authn/privacyIDEA flow.
As a proof-of-concept I’ve used authn/Function and it
returns a hardcoded username with domain. I can verify the
logs from the PrivacyIDEA module as well as the audit logs
on PrivacyIDEA that the user 2FA’d successfully. Shibboleth
of course doesn’t like that I just injected a username mid
authentication, so I need to update the current context with
the appended domain on the uid.<o:p></o:p></span></p>
<p class="MsoNormal"
style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-stroke-width: 0px;word-spacing:0px"><span
style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"
style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-stroke-width: 0px;word-spacing:0px"><span
style="color:black">This is the simple PoC script I used:<o:p></o:p></span></p>
<p class="MsoNormal"
style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-stroke-width: 0px;word-spacing:0px"><span
style="font-family:"Courier New";color:black"><bean
id="shibboleth.authn.Function.ResultLookupStrategy"</span><span
style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"
style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-stroke-width: 0px;word-spacing:0px"><span
style="font-family:"Courier New";color:black">
parent="shibboleth.ContextFunctions.Scripted"</span><span
style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"
style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-stroke-width: 0px;word-spacing:0px"><span
style="font-family:"Courier New";color:black">
factory-method="inlineScript"></span><span
style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"
style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-stroke-width: 0px;word-spacing:0px"><span
style="font-family:"Courier New";color:black">
<constructor-arg></span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"
style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-stroke-width: 0px;word-spacing:0px"><span
style="font-family:"Courier New";color:black">
<value></span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"
style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-stroke-width: 0px;word-spacing:0px"><span
style="font-family:"Courier New";color:black">
<![CDATA[</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"
style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-stroke-width: 0px;word-spacing:0px"><span
style="font-family:"Courier New";color:black">
var username = “<a href="mailto:user@example.org"
title="mailto:user@example.org" moz-do-not-send="true"><span
style="color:#000064">user@example.org</span></a>”;</span><span
style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"
style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-stroke-width: 0px;word-spacing:0px"><span
style="font-family:"Courier New";color:black">
username;</span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"
style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-stroke-width: 0px;word-spacing:0px"><span
style="font-family:"Courier New";color:black">
]]></span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"
style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-stroke-width: 0px;word-spacing:0px"><span
style="font-family:"Courier New";color:black">
</value></span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"
style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-stroke-width: 0px;word-spacing:0px"><span
style="font-family:"Courier New";color:black">
</constructor-arg></span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"
style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-stroke-width: 0px;word-spacing:0px"><span
style="font-family:"Courier New";color:black"></bean></span><span
style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"
style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-stroke-width: 0px;word-spacing:0px"><span
style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"
style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-stroke-width: 0px;word-spacing:0px"><span
style="color:black">And included in my MFA authn:<o:p></o:p></span></p>
<p class="MsoNormal"
style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-stroke-width: 0px;word-spacing:0px"><span
style="font-family:"Courier New";color:black">
<<a class="moz-txt-link-freetext" href="util:map">util:map</a> id="shibboleth.authn.MFA.TransitionMap"></span><span
style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"
style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-stroke-width: 0px;word-spacing:0px"><span
style="font-family:"Courier New";color:black">
<entry key=""></span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"
style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-stroke-width: 0px;word-spacing:0px"><span
style="font-family:"Courier New";color:black">
<bean parent="shibboleth.authn.MFA.Transition<a class="moz-txt-link-rfc2396E" href="p:nextFlow=">"
p:nextFlow="</a>authn/Password" /></span><span
style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"
style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-stroke-width: 0px;word-spacing:0px"><span
style="font-family:"Courier New";color:black">
</entry></span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"
style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-stroke-width: 0px;word-spacing:0px"><span
style="font-family:"Courier New";color:black"> </span><span
style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"
style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-stroke-width: 0px;word-spacing:0px"><span
style="font-family:"Courier New";color:black">
<entry key="authn/Password"></span><span
style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"
style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-stroke-width: 0px;word-spacing:0px"><span
style="font-family:"Courier New";color:black">
<bean parent="shibboleth.authn.MFA.Transition<a class="moz-txt-link-rfc2396E" href="p:nextFlow=">"
p:nextFlow="</a>authn/Function" /></span><span
style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"
style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-stroke-width: 0px;word-spacing:0px"><span
style="font-family:"Courier New";color:black">
</entry></span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"
style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-stroke-width: 0px;word-spacing:0px"><span
style="font-family:"Courier New";color:black"> </span><span
style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"
style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-stroke-width: 0px;word-spacing:0px"><span
style="font-family:"Courier New";color:black">
<entry key="authn/Function"></span><span
style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"
style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-stroke-width: 0px;word-spacing:0px"><span
style="font-family:"Courier New";color:black">
<bean parent="shibboleth.authn.MFA.Transition<a class="moz-txt-link-rfc2396E" href="p:nextFlow=">"
p:nextFlow="</a>authn/privacyIDEA" /></span><span
style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"
style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-stroke-width: 0px;word-spacing:0px"><span
style="font-family:"Courier New";color:black">
</entry></span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"
style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-stroke-width: 0px;word-spacing:0px"><span
style="font-family:"Courier New";color:black">
</<a class="moz-txt-link-freetext" href="util:map">util:map</a>></span><span style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"
style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-stroke-width: 0px;word-spacing:0px"><span
style="font-family:"Courier New";color:black"> </span><span
style="color:black"><o:p></o:p></span></p>
<p class="MsoNormal"
style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-stroke-width: 0px;word-spacing:0px"><span
style="color:black">My next step was to figure out how to
get the authenticating user out of the current context and
update it with a domain before it goes to the privacyIDEA
module, which isn’t configurable on what attribute to accept
as the user. How would I get the right context into my
script and update the username? Am I even going about this
the most efficient or correct way? Any help is appreciated.<o:p></o:p></span></p>
<p class="MsoNormal"
style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-stroke-width: 0px;word-spacing:0px"><span
style="color:black"> <o:p></o:p></span></p>
<p class="MsoNormal"
style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-stroke-width: 0px;word-spacing:0px"><span
style="color:black">Thanks,<o:p></o:p></span></p>
<p class="MsoNormal"
style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-stroke-width: 0px;word-spacing:0px"><span
style="color:black">Devin<o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<br>
<fieldset class="moz-mime-attachment-header"></fieldset>
</blockquote>
</body>
</html>