<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">No, there’s no session sharing between the authorization and token endpoints. I was talking in terms of tracking through the authorization step, which would eventually need to get distilled into the OAuth2Request object that gets saved and picked up in the latter part of the transaction.<div class=""><br class=""></div><div class=""> — Justin</div><div class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Mar 11, 2015, at 1:59 AM, Naveen Jamal <<a href="mailto:nj@tyfone.com" class="">nj@tyfone.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta http-equiv="Content-Type" content="text/html; charset=utf-8" class=""><div dir="ltr" class="">thanks justin.<div class=""><br class=""></div><div class="">the cleaner option seems like the way to go. that was the way i was trying to approach the problem.<div class=""><br class=""></div><div class="">as far as the first option, just to be clear, since the /token request originates from the relying party and the not the end user's browser, the two can't share any HTTP session info.. so you're suggesting using spring's security context object instead ? i'm very new to java and spring, so please bear with me :)</div></div><div class=""><br class=""></div><div class="">;n</div><div class=""><br class=""></div><div class=""><br class=""></div></div><div class="gmail_extra"><br class=""><div class="gmail_quote">On Tue, Mar 10, 2015 at 7:48 PM, Justin Richer <span dir="ltr" class=""><<a href="mailto:jricher@mit.edu" target="_blank" class="">jricher@mit.edu</a>></span> wrote:<br class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000" class="">
Naveen,<br class="">
<br class="">
Your best bet is probably going to be to put something into the
user's session to indicate how they came in, then reach into that
object when you're building the ID Token in your own version of the
OIDCTokenService. You can access Spring Security's current security
context object statically, so this shouldn't be hard to pull off. <br class="">
<br class="">
Alternatively (and probably more cleanly), you can save it into the
Authentication object itself, probably in the extensions Map that's
in there. We use that map for things like prompt conditions,
authentication time, and other components. Take a look at how the
AuthenticationTimeStamper class works as an example of this, which
sets the auth_age parameter in the ID Token.<br class="">
<br class="">
-- Justin<div class=""><div class="h5"><br class="">
<br class="">
<div class="">On 3/10/2015 8:02 AM, Naveen Jamal
wrote:<br class="">
</div>
</div></div><blockquote type="cite" class=""><div class=""><div class="h5">
<div dir="ltr" class="">hi all,
<div class=""><br class="">
</div>
<div class=""> i'm trying to extend the openid connect server to support
returning an acr value in the id_token based on how the user
authenticated (username/password, OTP, soft token, hard token,
...) . </div>
<div class=""><br class="">
</div>
<div class=""> i've been able to display a custom login form that
accepts the necessary extra text fields (along with username
and password) based on the acr_values passed to the authorize
endpoint, and can also validate the extra user input to decide
which acr was achieved.</div>
<div class=""><br class="">
</div>
<div class=""> i'm having trouble figuring out how to get the acr (as
inferred by the login submission) returned via token endpoint.
i see that i'll have to add acr to the idClaims object
in DefaultOIDCTokenService.java to get it to be returned
as part of the id_token, but can't figure out how to make the
acr value inferred at login form submission to be accessible
at the DefaultOIDCTokenService. Seems like it needs to be part
of the stored in the authentication longblob field in the
authorization_code table?</div>
<div class=""><br class="">
</div>
<div class=""> any suggestion on how i should go about this?</div>
<div class=""><br class="">
</div>
<div class=""> thanks in advance,</div>
<div class=""><br class="">
</div>
<div class="">-naveen</div>
<div class=""><br class="">
</div>
</div>
<br class="">
<fieldset class=""></fieldset>
<br class="">
</div></div><pre class="">_______________________________________________
mitreid-connect mailing list
<a href="mailto:mitreid-connect@mit.edu" target="_blank" class="">mitreid-connect@mit.edu</a>
<a href="http://mailman.mit.edu/mailman/listinfo/mitreid-connect" target="_blank" class="">http://mailman.mit.edu/mailman/listinfo/mitreid-connect</a>
</pre>
</blockquote>
<br class="">
</div>
</blockquote></div><br class=""></div>
</div></blockquote></div><br class=""></div></body></html>