Conditional steps based on HTTP context

[wso2]

Conditional steps based on HTTP context

[ruwanta]

Documentation

Configuring the service provider

• Create the service provider in normal steps
• Go to "Under local and outbound Authentication" configuration
• Select "Advanced Authentication"
• Select and configure more than one authentication steps. Each step can be either local, or federated. You can configure multi-option step too.
• Click on "Authentication Script", to unwrap the script editor.

Configuring steps based on request parameters

e.g. Use ACR from the authentication request to determine the level of assurance

• Pre-Requisites: Configure three steps in step configuration
• Here we use the "Authentication Context Class Reference" (ACR) from OpenId Connect.
• fails the authentication, If ACR is not present.

function onInitialRequest(context) {

   var acr = context.acr;
   switch (acr) {
     case "level0" : executeStep({id : '1'}); return;
     case "level1" : executeStep({id : '1'});executeStep({id : '2'}); return;
     case "level3" : executeStep({id : '1'});executeStep({id : '2'});;executeStep({id : '3'}); return;
     default: fail(); return;
   }
}

Configuring steps based on result of the first step

e.g.
Execute an additional authentication step if the user has a role "admin".

function onInitialRequest(context) {
   executeStep({
       id: '1',
       on: {
           success: function (context) {
               var isAdmin = hasRole(context, 'admin');
               Log.info("--------------- Has Admin " + isAdmin);
               if (isAdmin) {
                   executeStep({id: '2'});
	         executeStep({id: '3’'});
               }
           }
       }
   });
}

Using HTTP context to change authentication behavior

e.g.
Show the second factor when the user comes from a browser which is not seen previously.
We use a cookie to identify the browser in this situation

function onInitialRequest(context) {
	executeStep({
    	id: '1',
    	on: {
        	success: function (context) {

            	if (context.request.cookies.testcookie) {
                	log.info("--------------- cookie testcookie found in request.");
                	log.info("--------------- cookie testcookie.value: " + context.request.cookies.testcookie.value);
                	log.info("--------------- cookie testcookie.domain: " + context.request.cookies.testcookie.domain);
                	log.info("--------------- cookie testcookie.max-age: " + context.request.cookies.testcookie["max-age"]);
                	log.info("--------------- cookie testcookie.path: " + context.request.cookies.testcookie.path);
                	log.info("--------------- cookie testcookie.secure: " + context.request.cookies.testcookie.secure);
                	log.info("--------------- cookie testcookie.version: " + context.request.cookies.testcookie.version);
                	log.info("--------------- cookie testcookie.httpOnly: " + context.request.cookies.testcookie.httpOnly);
            	} else {
                	executeStep({
                    	id: '2',
                    	on: {
                        	success: function (context) {                               
                                log.info("--------------- setting cookie : testcookie");
							  	context.response.headers["Set-Cookie"] = "testcookie=1FD36B269C61; Path=/; Secure; HttpOnly; Expires=Wed, 21 Jan 2018 07:28:00 GMT"
                        	}
                    	}
                	});
            	}
        	}
    	}
	});
}