<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">On 7/11/2025 2:38 PM, Devin Ridge via
users wrote:<br>
</div>
<blockquote type="cite"
cite="mid:50E45A45-080F-49E9-B897-FC593E1B56EA@globalnoc.iu.edu">
<p class="MsoNormal"
style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-stroke-width: 0px;word-spacing:0px"><span
style="color:black">I’m trying to append a domain to uid,
temporarily, for an authentication module in MFA flow. The
first step is authn/Password with user credentials and the the
next step is authn/privacyIDEA via a module. The issue is that
uid, which we rely on in many places to not be scoped, needs
to be scoped for the authn/privacyIDEA flow. As a
proof-of-concept I’ve used authn/Function and it returns a
hardcoded username with domain. I can verify the logs from the
PrivacyIDEA module as well as the audit logs on PrivacyIDEA
that the user 2FA’d successfully. Shibboleth of course doesn’t
like that I just injected a username mid authentication, so I
need to update the current context with the appended domain on
the uid.<o:p></o:p></span></p>
<p class="MsoNormal"
style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-stroke-width: 0px;word-spacing:0px"><span
style="color:black">[...]</span></p>
<p class="MsoNormal"
style="caret-color: rgb(0, 0, 0);font-variant-caps: normal;orphans: auto;text-align:start;widows: auto;-webkit-text-stroke-width: 0px;word-spacing:0px"><span
style="color:black">My next step was to figure out how to get
the authenticating user out of the current context and update
it with a domain before it goes to the privacyIDEA module,
which isn’t configurable on what attribute to accept as the
user. How would I get the right context into my script and
update the username? Am I even going about this the most
efficient or correct way? Any help is appreciated.</span></p>
</blockquote>
<p>An idea off the top of my head: if you add some scripts to the
MFA transition map, you could grab the current username from the
appropriate context and save in in the ScratchContext and then
setting it to the scoped value prior to invoking the IDEA flow,
then restoring it afterwards. I think the Developer Resources has
a diagram in the Authentication section showing where the username
gets stashed.</p>
<pre class="moz-signature" cols="72">--
%% Christopher A. Bongaarts %% <a class="moz-txt-link-abbreviated" href="mailto:cab@umn.edu">cab@umn.edu</a> %%
%% OIT - Identity Management %% <a class="moz-txt-link-freetext" href="http://umn.edu/~cab">http://umn.edu/~cab</a> %%
%% University of Minnesota %% +1 (612) 625-1809 %%
</pre>
</body>
</html>