MCB, detecting that a different profile is being requested ...

[Steven Carmody]

Hi,

I'm using the MCB with my IDP, and I've configured authMethods for 
password and duo (I'm using David's DUO package). I can access an SP 
that requires only password, and that works fine. If I then access an SP 
that requires DUO, I'm allowed in (apparently) by the previous session 
manager. Interestingly, if I start by accessing an SP that requires DUO, 
it works as expected -- asks for a password, and then triggers the DUO 
support.

Here's some detailed info. Any thoughts or suggestions welcome !

If I go first to the SP requiring DUO, the IDP log file contains this:

Found idms attribute: brownAuthenticationProfiles
Found [2] values in attribute.
User authenticated with method [password]
Used context listed in valid contexts = [true]
Used context for principal [stc] is on the potential allowed list.
Used context listed in requested contexts = [false]
Principal [stc] must authenticate with a different context.
Force reauth = [false}
Found [1] allowable contexts to choose from.
Using submodule with bean name of [mcb.duo]

If I first login at the SP requiring just a password, and then access 
the DUO protected SP, the log file contains this when I access the DUO 
protected SP:

Used context listed in requested contexts = [false]
Simple case met. The used context is in the requested list for principal 
[stc]
Returning control to authentication engine

Interestingly, in this situation, the log file does NOT contain the 
first five lines in the log snippet above.

My MCB config file contains:

	<context name="urn:oasis:names:tc:SAML:2.0:ac:classes:Password" 
method="password">
          <allowedContexts>
          </allowedContexts>
     </context>

     <context 
name="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" 
method="password">
         <allowedContexts>
         </allowedContexts>
     </context>

     <context name="http://brown.edu/duo" method="duo">
         <allowedContexts>
         </allowedContexts>
     </context>

         <method name="password" bean="mcb.usernamepassword">
             Username/Password Only
         </method>

         <method name="duo" bean="mcb.duo">
         	Duo
	</method>