WSO2 Username matching between MFA steps - wso2

Question

I have an existing CAS Service Provider and I need to add multifactor authentication via AzureAD. I have it configured and "working", but the user can specify different accounts to gain access, and I want to require them to use the same username in both CAS (MFA step 1) and AzureAD (MFA step 2).
I have reviewed XACML policies, but I haven't found any documentation that indicates the policies can evaluate attributes from multiple authentication methods. Am I missing something or is XACML policy the wrong technology for accomplishing our use case of requiring the same username on both authentication methods?

Answer 1

Yes, you can't use XACML to achieve this use case. Because this is XACML policy can be applied after full authentication, but this use case is inside the authentication flow.
If you are using WSO2 IS 5.7.0, You can achieve this use case using adaptive authentication scripts
You need to just write the authentication script to compare the username of the both steps
function onLoginRequest(context) {
executeStep(1, {
onSuccess: function (context) {
executeStep(2, {
onSuccess: function (context){
if (!context.steps[1].subject.username != context.steps[2].subject.username) {
//
sendError('http://www.example.com/error',{'errorcode':'000403','errorMsg':'You are not allowed to login to this app.'});
}
}
});
}
});
}
If you are using older versions of IS, you need to write a custom authenticator for the same logic and add to the IS. Then add this authenticator as 3rd step.