IdP konfigurointi

cp /home/trainee/MPASSid-proxy/idp-authn-impl-socialuser/target/idp-authn-impl-socialuser-1.0-SNAPSHOT.jar /opt/shibboleth-idp/edit-webapp/WEB-INF/lib/.
cp /home/trainee/MPASSid-proxy/idp-authn-impl-socialuser/target/dependency/* /opt/shibboleth-idp/edit-webapp/WEB-INF/lib/.

source /etc/default/shibboleth

/opt/shibboleth-idp/bin/build.sh

systemctl restart shibboleth-idp.service
tail -f /opt/shibboleth-idp/logs/idp-process.log

<Call name="setAttribute">
  <Arg>org.eclipse.jetty.server.webapp.WebInfIncludeJarPattern</Arg>
  <Arg>.*/idp-authn-impl-socialuser[^/]*\.jar$</Arg>
</Call>

cp -r /home/trainee/MPASSid-proxy/idp-authn-impl-socialuser/src/main/resources/conf /opt/shibboleth-idp/.
cp -r /home/trainee/MPASSid-proxy/idp-authn-impl-socialuser/src/main/resources/flows /opt/shibboleth-idp/.
cp -r /home/trainee/MPASSid-proxy/idp-authn-impl-socialuser/src/main/resources/views /opt/shibboleth-idp/views/.

        <bean id="JWTPrivateKey"
			class="net.shibboleth.ext.spring.factory.PrivateKeyFactoryBean"
			p:resource="../../../credentials/mfaclient.pem" />
		
		<bean id="SetOIDCInformation" class="fi.okm.mpass.idp.authn.impl.SetOIDCInformation"
			p:privKey-ref="JWTPrivateKey" p:responseType="id_token">
			<property name="clientId" value="vm0XXX.kaj.pouta.csc.fi" />
			<property name="providerMetadataLocation" value="https://mfapilot.funet.fi" />
			<property name="redirectURI"
				value="https://vm0XXX.kaj.pouta.csc.fi/idp/Authn/SocialUserOpenIdConnectEnd" />
			<property name="Acr">
				<list>
					<value>urn:test:stepup</value>
				</list>
			</property>
			<property name="requestClaims">
				<map>
					<entry key="sub" value="uid" />
					<entry key="eppn" value="stepupEPPN" />
					<entry key="mobile" value="mobile" />
				</map>
			</property>
		</bean>

openssl genrsa -out /opt/shibboleth-idp/credentials/mfaclient.pem 2048
chmod 750 /opt/shibboleth-idp/credentials/mfaclient.pem
chown root:jetty /opt/shibboleth-idp/credentials/mfaclient.pem
openssl rsa -in /opt/shibboleth-idp/credentials/mfaclient.pem -outform PEM -pubout -out /opt/shibboleth-idp/credentials/mfaclientpublic.pem

yum install npm
npm install -g pem-jwk
mkdir /var/www/vm0XXX.kaj.pouta.csc.fi/www/keyset
pem-jwk /opt/shibboleth-idp/credentials/mfaclientpublic.pem > /var/www/vm0XXX.kaj.pouta.csc.fi/www/keyset/mfaclientkeyset.jwk

        <!-- only to be used by mfa, not to be activated separately -->
		<bean id="authn/SocialUserOpenIDConnect" parent="shibboleth.AuthenticationFlow"
			p:nonBrowserSupported="false" p:forcedAuthenticationSupported="true">
			<property name="supportedPrincipals">
				<list>
					<bean parent="shibboleth.SAML2AuthnContextClassRef"
						c:classRef="urn:test:stepup" />
				</list>
			</property>
		</bean>
		<bean id="authn/MFA" parent="shibboleth.AuthenticationFlow"
			p:passiveAuthenticationSupported="false"
			p:forcedAuthenticationSupported="true">
			<property name="supportedPrincipals">
				<list>
					<bean parent="shibboleth.SAML2AuthnContextClassRef"
						c:classRef="urn:test:stepup" />
				</list>
			</property>
		</bean>

       <util:map id="shibboleth.authn.MFA.TransitionMap">
            <!-- First rule runs the Password login flow. -->
            <entry key="">
                <bean parent="shibboleth.authn.MFA.Transition" p:nextFlow="authn/Password" />
            </entry>
            <!-- Second rule runs oidc mfa flow if password authentication succeeds. -->
            <entry key="authn/Password">
                <bean parent="shibboleth.authn.MFA.Transition"
                    p:nextFlowStrategy-ref="doSecondFactor" />
            </entry>
        </util:map>
        <!-- Resolves attributes and then runs oidc mfa flow. -->
        <bean id="doSecondFactor" parent="shibboleth.ContextFunctions.Scripted"
            factory-method="inlineScript" p:customObject-ref="shibboleth.AttributeResolverService">
            <constructor-arg>
                <value>
                <![CDATA[
                nextFlow = "authn/SocialUserOpenIDConnect";
                // Set up for an attribute lookup.
                authCtx = input.getSubcontext("net.shibboleth.idp.authn.context.AuthenticationContext");
                mfaCtx = authCtx.getSubcontext("net.shibboleth.idp.authn.context.MultiFactorAuthenticationContext");
                // Attributes are needed for second factor.
                resCtx = input.getSubcontext(
                "net.shibboleth.idp.attribute.resolver.context.AttributeResolutionContext", true);
				// Look up the username
                usernameLookupStrategyClass = Java.type("net.shibboleth.idp.session.context.navigate.CanonicalUsernameLookupStrategy");
                usernameLookupStrategy = new usernameLookupStrategyClass();
                resCtx.setPrincipal(usernameLookupStrategy.apply(input));
				resCtx.getRequestedIdPAttributeNames().add("uid");
                resCtx.getRequestedIdPAttributeNames().add("stepupEPPN");
                resCtx.getRequestedIdPAttributeNames().add("mobile");
                resCtx.resolveAttributes(custom);
                //Pass the resolved attributes to context
                suCtx = authCtx.getSubcontext("fi.okm.mpass.idp.authn.impl.SocialUserOpenIdConnectContext", true);
                suCtx.setResolvedIdPAttributes(resCtx.getResolvedIdPAttributes());
                input.removeSubcontext(resCtx);
                nextFlow; // pass control to oidc flow 
                ]remove]>
            </value>
        </constructor-arg>
    </bean>                

<resolver:AttributeDefinition xsi:type="ad:Simple"
    id="stepupEPPN" sourceAttributeID="eduPersonPrincipalName">
    <resolver:Dependency ref="myLDAP" />
</resolver:AttributeDefinition>

 idp.authn.flows= Password|MFA

 <!-- Logs MPASSid modules -->
 <logger name="fi.okm" level="DEBUG"/>

systemctl restart shibboleth-idp.service
tail -f /opt/shibboleth-idp/logs/idp-process.log

grep fi.okm.mpass.idp.authn.impl  /opt/shibboleth-idp/logs/idp-process.log

grep ValidateOIDCAuthenticationResponse /opt/shibboleth-idp/logs/idp-process.log