LG-12674 Ensure requested VTR is logged in SAML and OIDC endpoints

app/controllers/concerns/saml_idp_auth_concern.rb

@@ -55,9 +55,7 @@ def check_sp_active
   def validate_service_provider_and_authn_context
     return if result.success?
 
-    analytics.saml_auth(
-      **result.to_h.merge(request_signed: saml_request.signed?),
-    )
+    capture_analytics
     render 'saml_idp/auth/error', status: :bad_request
   end
 

app/controllers/openid_connect/authorization_controller.rb

@@ -156,6 +156,7 @@ def pre_validate_authorize_form
         **result.to_h.except(:redirect_uri, :code_digest).merge(
           user_fully_authenticated: user_fully_authenticated?,
           referer: request.referer,
+          vtr_param: params[:vtr],
         ),
       )
       return if result.success?
@@ -214,6 +215,8 @@ def track_events
         ial: event_ial_context.ial,
         billed_ial: event_ial_context.bill_for_ial_1_or_2,
         sign_in_flow: session[:sign_in_flow],
+        vtr: sp_session[:vtr],
+        acr_values: sp_session[:acr_values],
       )
       track_billing_events
     end

app/controllers/saml_idp_controller.rb

@@ -136,6 +136,7 @@ def log_external_saml_auth_request
 
     analytics.saml_auth_request(
       requested_ial: requested_ial,
+      authn_context: saml_request&.requested_authn_contexts,
       requested_aal_authn_context: saml_request&.requested_aal_authn_context,
       requested_vtr_authn_context: saml_request&.requested_vtr_authn_context,
       force_authn: saml_request&.force_authn?,
@@ -181,6 +182,8 @@ def track_events
       ial: resolved_authn_context_int_ial,
       billed_ial: ial_context.bill_for_ial_1_or_2,
       sign_in_flow: session[:sign_in_flow],
+      vtr: sp_session[:vtr],
+      acr_values: sp_session[:acr_values],
     )
     track_billing_events
   end

app/services/analytics_events.rb

@@ -3800,13 +3800,15 @@ def openid_connect_bearer_token(success:, ial:, client_id:, errors:, **extra)
   # @param [String] scope
   # @param [Array] acr_values
   # @param [Array] vtr
+  # @param [String, nil] vtr_param
   # @param [Boolean] unauthorized_scope
   # @param [Boolean] user_fully_authenticated
   def openid_connect_request_authorization(
     client_id:,
     scope:,
     acr_values:,
     vtr:,
+    vtr_param:,
     unauthorized_scope:,
     user_fully_authenticated:,
     **extra
@@ -3817,6 +3819,7 @@ def openid_connect_request_authorization(
       scope: scope,
       acr_values: acr_values,
       vtr: vtr,
+      vtr_param: vtr_param,
       unauthorized_scope: unauthorized_scope,
       user_fully_authenticated: user_fully_authenticated,
       **extra,
@@ -4459,13 +4462,25 @@ def rules_of_use_visit
   # @param [Array] authn_context
   # @param [String] authn_context_comparison
   # @param [String] service_provider
+  # @param [String] endpoint
+  # @param [Boolean] idv
+  # @param [Boolean] finish_profile
+  # @param [Integer] requested_ial
+  # @param [Boolean] request_signed
+  # @param [String] matching_cert_serial
   def saml_auth(
     success:,
     errors:,
     nameid_format:,
     authn_context:,
     authn_context_comparison:,
     service_provider:,
+    endpoint:,
+    idv:,
+    finish_profile:,
+    requested_ial:,
+    request_signed:,
+    matching_cert_serial:,
     **extra
   )
     track_event(
@@ -4476,29 +4491,47 @@ def saml_auth(
       authn_context: authn_context,
       authn_context_comparison: authn_context_comparison,
       service_provider: service_provider,
+      endpoint: endpoint,
+      idv: idv,
+      finish_profile: finish_profile,
+      requested_ial: requested_ial,
+      request_signed: request_signed,
+      matching_cert_serial: matching_cert_serial,
       **extra,
     )
   end
 
   # @param [Integer] requested_ial
-  # @param [String,nil] requested_aal_authn_context
-  # @param [Boolean,nil] force_authn
+  # @param [Array] authn_context
+  # @param [String, nil] requested_aal_authn_context
+  # @param [String, nil] requested_vtr_authn_context
+  # @param [Boolean] force_authn
+  # @param [Boolean] final_auth_request
   # @param [String] service_provider
+  # @param [Boolean] user_fully_authenticated
   # An external request for SAML Authentication was received
   def saml_auth_request(
     requested_ial:,
+    authn_context:,
     requested_aal_authn_context:,
+    requested_vtr_authn_context:,
     force_authn:,
+    final_auth_request:,
     service_provider:,
+    user_fully_authenticated:,
     **extra
   )
     track_event(
       'SAML Auth Request',
       {
         requested_ial: requested_ial,
+        authn_context: authn_context,
         requested_aal_authn_context: requested_aal_authn_context,
+        requested_vtr_authn_context: requested_vtr_authn_context,
         force_authn: force_authn,
+        final_auth_request: final_auth_request,
         service_provider: service_provider,
+        user_fully_authenticated: user_fully_authenticated,
         **extra,
       }.compact,
     )
@@ -4624,12 +4657,16 @@ def sp_inactive_visit
   # @param [Integer] ial
   # @param [Integer] billed_ial
   # @param [String, nil] sign_in_flow
-  def sp_redirect_initiated(ial:, billed_ial:, sign_in_flow:, **extra)
+  # @param [String, nil] vtr
+  # @param [String, nil] acr_values
+  def sp_redirect_initiated(ial:, billed_ial:, sign_in_flow:, vtr:, acr_values:, **extra)
     track_event(
       'SP redirect initiated',
       ial:,
       billed_ial:,
       sign_in_flow:,
+      vtr: vtr,
+      acr_values: acr_values,
       **extra,
     )
   end

spec/controllers/openid_connect/authorization_controller_spec.rb

@@ -119,7 +119,8 @@
                    code_challenge_present: false,
                    service_provider_pkce: nil,
                    scope: 'openid',
-                   vtr: nil)
+                   vtr: nil,
+                   vtr_param: '')
             expect(@analytics).to receive(:track_event).
               with('OpenID Connect: authorization request handoff',
                    success: true,
@@ -132,6 +133,8 @@
                 ial: 1,
                 billed_ial: 1,
                 sign_in_flow:,
+                acr_values: 'http://idmanagement.gov/ns/assurance/ial/1',
+                vtr: nil,
               )
 
             IdentityLinker.new(user, service_provider).link_identity(ial: 1)
@@ -168,7 +171,8 @@
                    code_challenge_present: false,
                    service_provider_pkce: nil,
                    scope: 'openid',
-                   vtr: ['C1'])
+                   vtr: ['C1'],
+                   vtr_param: ['C1'].to_json)
             expect(@analytics).to receive(:track_event).
               with('OpenID Connect: authorization request handoff',
                    success: true,
@@ -181,6 +185,8 @@
                 ial: 1,
                 billed_ial: 1,
                 sign_in_flow:,
+                acr_values: '',
+                vtr: ['C1'],
               )
 
             IdentityLinker.new(user, service_provider).link_identity(ial: 1)
@@ -354,7 +360,8 @@
                      code_challenge_present: false,
                      service_provider_pkce: nil,
                      scope: 'openid profile',
-                     vtr: nil)
+                     vtr: nil,
+                     vtr_param: '')
               expect(@analytics).to receive(:track_event).
                 with('OpenID Connect: authorization request handoff',
                      success: true,
@@ -367,6 +374,8 @@
                   ial: 2,
                   billed_ial: 2,
                   sign_in_flow:,
+                  acr_values: 'http://idmanagement.gov/ns/assurance/ial/2',
+                  vtr: nil,
                 )
 
               IdentityLinker.new(user, service_provider).link_identity(ial: 2)
@@ -728,7 +737,8 @@
                        code_challenge_present: false,
                        service_provider_pkce: nil,
                        scope: 'openid profile',
-                       vtr: nil)
+                       vtr: nil,
+                       vtr_param: '')
                 expect(@analytics).to receive(:track_event).
                   with('OpenID Connect: authorization request handoff',
                        success: true,
@@ -741,6 +751,8 @@
                     ial: 0,
                     billed_ial: 2,
                     sign_in_flow:,
+                    acr_values: 'http://idmanagement.gov/ns/assurance/ial/0',
+                    vtr: nil,
                   )
 
                 IdentityLinker.new(user, service_provider).link_identity(ial: 2)
@@ -813,7 +825,8 @@
                        code_challenge_present: false,
                        service_provider_pkce: nil,
                        scope: 'openid profile',
-                       vtr: nil)
+                       vtr: nil,
+                       vtr_param: '')
                 expect(@analytics).to receive(:track_event).
                   with('OpenID Connect: authorization request handoff',
                        success: true,
@@ -825,6 +838,8 @@
                   ial: 0,
                   billed_ial: 1,
                   sign_in_flow:,
+                  acr_values: 'http://idmanagement.gov/ns/assurance/ial/0',
+                  vtr: nil,
                 )
 
                 IdentityLinker.new(user, service_provider).link_identity(ial: 1)
@@ -899,7 +914,8 @@
                        code_challenge_present: false,
                        service_provider_pkce: nil,
                        scope: 'openid profile',
-                       vtr: nil)
+                       vtr: nil,
+                       vtr_param: '')
                 expect(@analytics).to receive(:track_event).
                   with('OpenID Connect: authorization request handoff',
                        success: true,
@@ -911,6 +927,8 @@
                   ial: 0,
                   billed_ial: 1,
                   sign_in_flow:,
+                  acr_values: 'http://idmanagement.gov/ns/assurance/ial/0',
+                  vtr: nil,
                 )
 
                 IdentityLinker.new(user, service_provider).link_identity(ial: 1)
@@ -1102,7 +1120,8 @@
                  code_challenge_present: false,
                  service_provider_pkce: nil,
                  scope: 'openid',
-                 vtr: nil)
+                 vtr: nil,
+                 vtr_param: '')
           expect(@analytics).to_not receive(:track_event).with('sp redirect initiated')
 
           action
@@ -1136,7 +1155,8 @@
                  code_challenge_present: false,
                  service_provider_pkce: nil,
                  scope: 'openid',
-                 vtr: nil)
+                 vtr: nil,
+                 vtr_param: '')
           expect(@analytics).to_not receive(:track_event).with('SP redirect initiated')
 
           action
@@ -1254,6 +1274,7 @@
             service_provider_pkce: nil,
             scope: 'openid',
             vtr: nil,
+            vtr_param: '',
           )
 
         action