<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=1.0">
<base href="https://issues.shibboleth.net/jira">
<title>Message Title</title>
</head>
<body class="jira" style="color: #333333; font-family: Arial, sans-serif; font-size: 14px; line-height: 1.429">
<table id="background-table" cellpadding="0" cellspacing="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; background-color: #f5f5f5; border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt" bgcolor="#f5f5f5">
<!-- header here -->
<tbody>
<tr>
<td id="header-pattern-container" style="padding: 0px; border-collapse: collapse; padding: 10px 20px">
<table id="header-pattern" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tbody>
<tr>
<td id="header-avatar-image-container" valign="top" style="padding: 0px; border-collapse: collapse; vertical-align: top; width: 32px; padding-right: 8px" width="32"> <img id="header-avatar-image" class="image_fix" src="cid:jira-generated-image-avatar-fe63a8cd-82a3-4754-84a3-f1e4b3999848" height="32" width="32" border="0" style="border-radius: 3px; vertical-align: top"> </td>
<td id="header-text-container" valign="middle" style="padding: 0px; border-collapse: collapse; vertical-align: middle; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px"> <a class="user-hover" rel="anne@rockefeller.edu" id="email_anne@rockefeller.edu" href="https://issues.shibboleth.net/jira/secure/ViewProfile.jspa?name=anne%40rockefeller.edu" style="color:#0052cc;; color: #3b73af; text-decoration: none">Anne Duffy</a> <strong>created</strong> an issue </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td id="email-content-container" style="padding: 0px; border-collapse: collapse; padding: 0 20px">
<table id="email-content-table" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; border-spacing: 0; border-collapse: separate">
<tbody>
<tr>
<!-- there needs to be content in the cell for it to render in some clients -->
<td class="email-content-rounded-top mobile-expand" style="padding: 0px; border-collapse: collapse; color: #ffffff; padding: 0 15px 0 16px; height: 15px; background-color: #ffffff; border-left: 1px solid #cccccc; border-top: 1px solid #cccccc; border-right: 1px solid #cccccc; border-bottom: 0; border-top-right-radius: 5px; border-top-left-radius: 5px; height: 10px; line-height: 10px; padding: 0 15px 0 16px; mso-line-height-rule: exactly" height="10" bgcolor="#ffffff"> </td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="padding: 0px; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff" bgcolor="#ffffff">
<table class="page-title-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tbody>
<tr>
<td class="page-title-pattern-first-line " style="padding: 0px; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; padding-top: 10px"> <a href="https://issues.shibboleth.net/jira/browse/SDSJ" style="color: #3b73af; text-decoration: none">Centralized Discovery Service</a> / <a href="https://issues.shibboleth.net/jira/browse/SDSJ-129" style="color: #3b73af; text-decoration: none"><img src="cid:jira-generated-image-avatar-a2eb683c-a832-4372-b13d-fdc9e18b3de2" height="16" width="16" border="0" align="absmiddle" alt="Bug" style="vertical-align: text-bottom"></a> <a href="https://issues.shibboleth.net/jira/browse/SDSJ-129" style="color: #3b73af; text-decoration: none">SDSJ-129</a> </td>
</tr>
<tr>
<td style="vertical-align: top;; padding: 0px; border-collapse: collapse; padding-right: 5px; font-size: 20px; line-height: 30px; mso-line-height-rule: exactly" class="page-title-pattern-header-container"> <span class="page-title-pattern-header" style="font-family: Arial, sans-serif; padding: 0; font-size: 20px; line-height: 30px; mso-text-raise: 2px; mso-line-height-rule: exactly; vertical-align: middle"> <a href="https://issues.shibboleth.net/jira/browse/SDSJ-129" style="color: #3b73af; text-decoration: none">TransitionMultiFactorAuthentication: Targeted login flow 'authn/Duo' does not support forced re-authentication</a> </span> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td class="email-content-main mobile-expand wrapper-special-margin" style="padding: 0px; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff; padding-top: 10px; padding-bottom: 5px" bgcolor="#ffffff">
<table class="keyvalue-table" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tbody>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Issue Type:</th>
<td class="has-icon" style="padding: 0px; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> <img src="cid:jira-generated-image-avatar-a2eb683c-a832-4372-b13d-fdc9e18b3de2" height="16" width="16" border="0" align="absmiddle" alt="Bug" style="vertical-align: text-bottom"> Bug </td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Assignee:</th>
<td style="padding: 0px; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> <a class="user-hover" rel="rdw@iay.org.uk" id="email_rdw@iay.org.uk" href="https://issues.shibboleth.net/jira/secure/ViewProfile.jspa?name=rdw%40iay.org.uk" style="color:#0052cc;; color: #3b73af; text-decoration: none">Rod Widdowson</a> </td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Created:</th>
<td style="padding: 0px; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> 13/Jul/21 1:44 PM </td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Labels:</th>
<td style="padding: 0px; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> TransitionMultiFactorAuthentication </td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Priority:</th>
<td class="has-icon" style="padding: 0px; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> <img src="cid:jira-generated-image-static-major-e14e8b4c-1d82-45b9-8224-0fc6999b2f17" height="16" width="16" border="0" align="absmiddle" alt="Major" style="vertical-align: text-bottom"> Major </td>
</tr>
<tr>
<th style="color: #707070; font: normal 14px/20px Arial, sans-serif; text-align: left; vertical-align: top; padding: 2px 0">Reporter:</th>
<td style="padding: 0px; border-collapse: collapse; font: normal 14px/20px Arial, sans-serif; padding: 2px 0 2px 5px; vertical-align: top"> <a class="user-hover" rel="anne@rockefeller.edu" id="email_anne@rockefeller.edu" href="https://issues.shibboleth.net/jira/secure/ViewProfile.jspa?name=anne%40rockefeller.edu" style="color:#0052cc;; color: #3b73af; text-decoration: none">Anne Duffy</a> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td class="email-content-main mobile-expand issue-description-container" style="padding: 0px; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff; padding-top: 5px; padding-bottom: 10px" bgcolor="#ffffff">
<table class="text-paragraph-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 2px">
<tbody>
<tr>
<td class="text-paragraph-pattern-container mobile-resize-text " style="padding: 0px; border-collapse: collapse; padding: 0 0 10px 0"> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0; margin-top: 0">We are using IDP : 3.4.1 version. After implementing MFA for NIH, first factor Login authentication is working fine, then page gets redirected to second factor (Duo), receiving the following error. Any help is really appreciated</p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0">I referenced the following document, not sure what am I missing:</p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0"><a href="https://shibboleth.atlassian.net/wiki/spaces/KB/pages/1474297850/Supporting+the+REFEDS+MFA+Profile" class="external-link" target="_blank" rel="nofollow noopener" style="color: #3b73af; text-decoration: none">Supporting the REFEDS MFA Profile - Shibboleth Knowledge Base - Shibboleth Wiki (atlassian.net)</a></p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0"><ins>Here is the idp log:</ins></p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0">2021-07-12 13:07:03,552 - DEBUG <span class="error">[net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:?]</span> - Profile Action TransitionMultiFactorAuthentication: Applying MFA transition rule to exit state 'authn/Password'</p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0">2021-07-12 13:07:03,568 - DEBUG <span class="error">[net.shibboleth.idp.authn.principal.PrincipalEvalPredicateFactoryRegistry:?]</span> - Registry located predicate factory of type 'net.shibboleth.idp.authn.principal.impl.ExactPrincipalEvalPredicateFactory' for principal type 'class net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal' and operator 'exact'</p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0">2021-07-12 13:07:03,568 - DEBUG <span class="error">[net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:?]</span> - Profile Action TransitionMultiFactorAuthentication: MFA flow transition after 'proceed' event to 'authn/Duo' flow</p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0">2021-07-12 13:07:03,568 - ERROR <span class="error">[net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:290]</span> - Profile Action TransitionMultiFactorAuthentication: <b><font color="#0747a6">Targeted login flow 'authn/Duo' does not support forced re-authentication</font></b></p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0">2021-07-12 13:07:03,572 - WARN <span class="error">[org.opensaml.profile.action.impl.LogEvent:105]</span> - A non-proceed event occurred while processing the request: RequestUnsupported</p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0">2021-07-12 13:07:03,583 - DEBUG <span class="error">[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:?]</span> - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.messaging.handler.impl.BasicMessageHandlerChain' on OUTBOUND message context</p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0">2021-07-12 13:07:03,583 - DEBUG <span class="error">[net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:?]</span> - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.ResponseImpl'</p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0">2021-07-12 13:07:03,583 - DEBUG <span class="error">[net.shibboleth.idp.saml.profile.impl.SpringAwareMessageEncoderFactory:?]</span> - Looking up message encoder based on binding URI: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST</p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0">2021-07-12 13:07:03,586 - DEBUG <span class="error">[PROTOCOL_MESSAGE:?]</span> -</p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0"><?xml version="1.0" encoding="UTF-8"?><saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="<a href="https://federation.nih.gov/Shibboleth.sso/SAML2/POST" class="external-link" target="_blank" rel="nofollow noopener" style="color: #3b73af; text-decoration: none">https://federation.nih.gov/Shibboleth.sso/SAML2/POST</a>" ID="_2374d70a65b269080befa94986619158" InResponseTo="_d7170118348da48a64c60f198474f750" IssueInstant="2021-07-12T17:07:03.579Z" Version="2.0"></p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0"> <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"><a href="https://rushib.rockefeller.edu/idp/shibboleth%3c/saml2:Issuer" class="external-link" target="_blank" rel="nofollow noopener" style="color: #3b73af; text-decoration: none">https://rushib.rockefeller.edu/idp/shibboleth</saml2:Issuer</a>></p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0"> <saml2p:Status></p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0"> <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Requester"></p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0"> <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:NoAuthnContext"/></p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0"> </saml2p:StatusCode></p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0"> <saml2p:StatusMessage>An error occurred.</saml2p:StatusMessage></p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0"> </saml2p:Status></p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0"></saml2p:Response></p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0"> </p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0">2021-07-12 13:07:03,586 - DEBUG <span class="error">[net.shibboleth.idp.profile.impl.RecordResponseComplete:?]</span> - Profile Action RecordResponseComplete: Record response complete</p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0">2021-07-12 13:07:03,586 - INFO <span class="error">[Shibboleth-Audit.SSO:?]</span> - 20210712T170703Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_d7170118348da48a64c60f198474f750|https://federation.nih.gov/FederationGateway|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://rushib.rockefeller.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_2374d70a65b269080befa94986619158||||||</p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0"> </p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0">Thank you in Advance,</p> <p style="margin-top:0;margin-bottom:10px;; margin: 10px 0 0 0"> </p> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td class="email-content-main mobile-expand " style="padding: 0px; border-collapse: collapse; border-left: 1px solid #cccccc; border-right: 1px solid #cccccc; border-top: 0; border-bottom: 0; padding: 0 15px 0 16px; background-color: #ffffff" bgcolor="#ffffff">
<table id="actions-pattern" cellspacing="0" cellpadding="0" border="0" width="100%" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 1px">
<tbody>
<tr>
<td id="actions-pattern-container" valign="middle" style="padding: 0px; border-collapse: collapse; padding: 10px 0 10px 24px; vertical-align: middle; padding-left: 0">
<table align="left" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tbody>
<tr>
<td class="actions-pattern-action-icon-container" style="padding: 0px; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 0; vertical-align: middle"> <a href="https://issues.shibboleth.net/jira/browse/SDSJ-129#add-comment" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none"> <img class="actions-pattern-action-icon-image" src="cid:jira-generated-image-static-comment-icon-5e2e1b1d-2460-4c47-af76-8044282bada7" alt="Add Comment" title="Add Comment" height="16" width="16" border="0" style="vertical-align: middle"> </a> </td>
<td class="actions-pattern-action-text-container" style="padding: 0px; border-collapse: collapse; font-family: Arial, sans-serif; font-size: 14px; line-height: 20px; mso-line-height-rule: exactly; mso-text-raise: 4px; padding-left: 5px"> <a href="https://issues.shibboleth.net/jira/browse/SDSJ-129#add-comment" target="_blank" title="Add Comment" style="color: #3b73af; text-decoration: none">Add Comment</a> </td>
</tr>
</tbody>
</table> </td>
</tr>
</tbody>
</table> </td>
</tr>
<!-- there needs to be content in the cell for it to render in some clients -->
<tr>
<td class="email-content-rounded-bottom mobile-expand" style="padding: 0px; border-collapse: collapse; color: #ffffff; padding: 0 15px 0 16px; height: 5px; line-height: 5px; background-color: #ffffff; border-top: 0; border-left: 1px solid #cccccc; border-bottom: 1px solid #cccccc; border-right: 1px solid #cccccc; border-bottom-right-radius: 5px; border-bottom-left-radius: 5px; mso-line-height-rule: exactly" height="5" bgcolor="#ffffff"> </td>
</tr>
</tbody>
</table> </td>
</tr>
<tr>
<td id="footer-pattern" style="padding: 0px; border-collapse: collapse; padding: 12px 20px">
<table id="footer-pattern-container" cellspacing="0" cellpadding="0" border="0" style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tbody>
<tr>
<td id="footer-pattern-text" class="mobile-resize-text" width="100%" style="padding: 0px; border-collapse: collapse; color: #999999; font-size: 12px; line-height: 18px; font-family: Arial, sans-serif; mso-line-height-rule: exactly; mso-text-raise: 2px"> This message was sent by Atlassian Jira <span id="footer-build-information">(v8.5.4#805004-<span title="0444eab799707f9ad7b248d69f858774aadfd250" data-commit-id="0444eab799707f9ad7b248d69f858774aadfd250}">sha1:0444eab</span>)</span> </td>
<td id="footer-pattern-logo-desktop-container" valign="top" style="padding: 0px; border-collapse: collapse; padding-left: 20px; vertical-align: top">
<table style="border-collapse: collapse; mso-table-lspace: 0pt; mso-table-rspace: 0pt">
<tbody>
<tr>
<td id="footer-pattern-logo-desktop-padding" style="padding: 0px; border-collapse: collapse; padding-top: 3px"> <img id="footer-pattern-logo-desktop" src="https://issues.shibboleth.net/jira/images/mail/atlassian-email-logo.png" alt="Atlassian logo" title="Atlassian logo" width="191" height="24" class="image_fix"> </td>
</tr>
</tbody>
</table> </td>
</tr>
</tbody>
</table> </td>
</tr>
</tbody>
</table>
</body>
</html>