My ultimate goal is to write an authenticator which can check if a user’s identity provider login used MFA or not and I’m trying to achieve this by writing a script which view the claim values from the user, such as the acr claim value.

So I’ve written a custom authenticator script and set it as the identity provider post login flow. The script runs but always crashes at some point when I’m only trying to log values. I’m having issues with the syntax and Keycloak API. I just want a way to log the claims, I’ve tried many variants like this and had no success. I’m just looking for the correct way to log each claim (key and value), from there I can add some conditional logic (I’m still investigating if this method can be used to verify MFA).

AuthenticationFlowError = Java.type("org.keycloak.authentication.AuthenticationFlowError");

function logMapElements(value, key, map) {
  LOG.info("key");
  LOG.info(key);
  LOG.info("value");
  LOG.info(value);
  return;
}

function authenticate(context) {

  LOG.info(script.name + " --> trace auth for: " + user.username);
  LOG.info("context now");
  LOG.info(context);
  LOG.info("permisissions now");
  var permissions = context.getPermissions();
  LOG.info(permissions);
 for (let i = 0; i < permissions.length; i++) {
      var claims = permissions[i].getClaims();
      claims.forEach(logMapElements);
  }


  context.success();
}