How to ensure the same Principal is used during authentication chain in OpenAM?

StackOverflow https://stackoverflow.com/questions/19834596

  •  25-07-2022
  •  | 
  •  

Question

I need to set up a two-step authentication chain with OpenAM. In the first step, the module requests a user certificate (which has to have been previously linked with an userID) and sends it to an external web service that will validate it and return the userID, which becomes the name of the Principal:

public Principal getPrincipal()
{
    return new DataStorePrincipal(userID);
}

On the second step, the module asks the user to type in his userID and password. How do I make sure that the userID typed is the same as the one from step 1?

The modules are chained like this:

  1. Certificate - REQUISITE
  2. ID/Password - REQUIRED
Was it helpful?

Solution

The first module could save the 'userId' in the shared-state map, the 2nd module can read it from the shared-state map. You may look at existing auth-modules source as they provide support for 'shared-state'

You may also look at 'http://docs.forgerock.org/en/openam/10.1.0/admin-guide/index.html#configure-authn-chains'

Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow
scroll top