Skip to content

fix: requestedAuthnContext from service overrided by idp requested AuthnContext in disco

Jan Pavlíček requested to merge xpavlic/disco_mfa_fix into main

Description

When a user on the discovery service selected IDP, it created a new instance of the Disco object, and the requested authentication context from SP was overridden by ones that were requested from the selected IDP before the redirect. This MR is fixing this issue.

How to test

Can be tested on lsaai idp1 (the testing scenario is in the Other information ).

Author's checklist

  • I have followed the contribution guidelines
  • This MR has been tested or does not change functionality
  • I have added relevant merge request dependencies (if this MR has any)
  • I have added the correct labels
  • I have assigned reviewers (if any are relevant)
  • I have edited the documentation (if the changes require it) or I have noted the need for the change if I do not have access to the documentation
  • I have marked all introduced BREAKING CHANGES or necessary DEPLOYMENT NOTES in the commit message(s)

Reviewer's checklist

  • This MR has been tested or does not change functionality
  • This MR has correct commit message format

Other information

Testing scenario: Log in to the spring app without MFA, go to the service that requests MFA, and try to log in with the same IDP (IDP uses the session without MFA). MFA pages will be correctly prompted on LSAAI.

With tokens image

Without tokens image

Edited by Jan Pavlíček

Merge request reports