Requested PasswordProtectedTransport auth context & MCB

IAM David Bantz dabantz at alaska.edu
Tue Jul 7 16:22:24 EDT 2015 

I'm no longer seeing the IdP log error parsing incoming SAML. But I am
seeing the following anomaly with MCB and the following requested authn
context in the SAML request:

   <samlp:RequestedAuthnContext
xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" Comparison="exact">

        <saml:AuthnContextClassRef
xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
        </saml:AuthnContextClassRef>

   </samlp:RequestedAuthnContext>

My account requires 2FA based on LDAP attribute; I successfully authN with
password + Duo.

Another user with no such LDAP attribute requiring 2FA successfully binds
to LDAP, but the MCB rejects the authN as not meeting the requirement.

MCB log snippets for both transactions are at the end of this email.

Presumably some part of the MCB configuration should be changed to allow
method password to satisfy the requested context of
PasswordProtectedTransport;
a pointer to what needs to change would be appreciated.

Here's what I have in multi-context-broker.xml

    <initialAuthContext requestedOnly="false">

            <context name="urn:oasis:names:tc:SAML:2.0:ac:classes:
PasswordProtectedTransport" />

    </initialAuthContext>

and this under authnContexts:

        <context name="urn:oasis:names:tc:SAML:2.0:ac:classes:
PasswordProtectedTransport" method="password">

            <allowedContexts>

                <context name="https://iam.alaska.edu/trac/wiki/mfa" />

            </allowedContexts>

        </context>

Here are log snippets from the two transactions:

Successful authN via LDAP; no directory attribute requiring 2FA;

then the MCB reports:

11:40:10.888 - DEBUG [...MCBLoginServlet:217] - Found idms attribute: null

11:40:10.888 - DEBUG [...MCBLoginServlet:219] - Found [0] values in
attribute.

11:40:10.889 - DEBUG [...MCBLoginServlet:227] - User authenticated with
method [password]

11:40:10.889 - TRACE [...MCBConfiguration:316] - mtc = [password]

11:40:10.889 - TRACE [...MCBLoginServlet:234] - Used context =
[urn:oasis:names:tc:SAML:2.0:ac:classes:Password]

11:40:10.889 - TRACE [...MCBLoginServlet:234] - Used context =
[urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport]

11:40:10.889 - TRACE [...MCBConfiguration:340] - Looking for value
[urn:oasis:names:tc:SAML:2.0:ac:classes:Password] in list.

11:40:10.889 - TRACE [...MCBConfiguration:340] - Looking for value
[urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport] in list.

11:40:10.889 - DEBUG [...MCBLoginServlet:257] - Used context listed in
valid contexts = [false]

11:40:10.889 - DEBUG [...MCBLoginServlet:261] - User [ssonwalkar] used a
context NOT on the potential context list. They must re-authenticate with a
valid context.

11:40:10.890 - TRACE [...MCBConfiguration:366] - Container context:
[urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport]

11:40:10.890 - TRACE [...MCBConfiguration:381] - Looking for context
[urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport] to be
satisfied by a higher level context.

11:40:10.890 - TRACE [...MCBConfiguration:413] -   Adding context of
[urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport]

11:40:10.890 - TRACE [...MCBConfiguration:500] -   Adding context of [
https://iam.alaska.edu/trac/wiki/mfa]

11:40:10.890 - TRACE [...MCBConfiguration:433] -  containerWithChildren
[urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport]

11:40:10.890 - TRACE [...MCBConfiguration:433] -  containerWithChildren [
https://iam.alaska.edu/trac/wiki/mfa]

11:40:10.890 - TRACE [...MCBConfiguration:398] - Returning ordered list
with [0] elements.

11:40:10.890 - DEBUG [...MCBLoginServlet:544] - Found [0] allowable
contexts to choose from.

11:40:10.890 - WARN [...MCBLoginServlet:573] - Unable to satisfy requested
authentication context of
[[urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport]].

                      Returning SAML error to SP.

11:40:10.891 - DEBUG [...MCBLoginServlet:156] - Authentication result =
[false]

corresponding login for dabantz (with 2FA required):
11:37:29.918 - DEBUG [...MCBLoginServlet:217] - Found idms attribute:
assurance

11:37:29.918 - DEBUG [...MCBLoginServlet:219] - Found [1] values in
attribute.

11:37:29.918 - DEBUG [...MCBLoginServlet:227] - User authenticated with
method [password]

11:37:29.918 - TRACE [...MCBConfiguration:316] - mtc = [password]

11:37:29.918 - TRACE [...MCBLoginServlet:234] - Used context =
[urn:oasis:names:tc:SAML:2.0:ac:classes:Password]

11:37:29.918 - TRACE [...MCBLoginServlet:234] - Used context =
[urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport]

11:37:29.918 - TRACE [...MCBConfiguration:340] - Looking for value
[urn:oasis:names:tc:SAML:2.0:ac:classes:Password] in list.

11:37:29.918 - TRACE [...MCBConfiguration:340] - Looking for value
[urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport] in list.

11:37:29.918 - DEBUG [...MCBLoginServlet:257] - Used context listed in
valid contexts = [false]

11:37:29.919 - DEBUG [...MCBLoginServlet:261] - User [dabantz] used a
context NOT on the potential context list. They must re-authenticate with a
valid context.

11:37:29.919 - TRACE [...MCBConfiguration:363] - Source context: [
https://iam.alaska.edu/trac/wiki/mfa]

11:37:29.919 - TRACE [...MCBConfiguration:366] - Container context:
[urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport]

11:37:29.919 - TRACE [...MCBConfiguration:381] - Looking for context
[urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport] to be
satisfied by a higher level context.

11:37:29.919 - TRACE [...MCBConfiguration:413] -   Adding context of
[urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport]

11:37:29.919 - TRACE [...MCBConfiguration:500] -   Adding context of [
https://iam.alaska.edu/trac/wiki/mfa]

11:37:29.919 - TRACE [...MCBConfiguration:433] -  containerWithChildren
[urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport]

11:37:29.919 - TRACE [...MCBConfiguration:433] -  containerWithChildren [
https://iam.alaska.edu/trac/wiki/mfa]

11:37:29.920 - TRACE [...MCBConfiguration:391] - Adding context [
https://iam.alaska.edu/trac/wiki/mfa] to ordered list.

11:37:29.920 - TRACE [...MCBConfiguration:398] - Returning ordered list
with [1] elements.

11:37:29.920 - DEBUG [...MCBLoginServlet:544] - Found [1] allowable
contexts to choose from.

11:37:29.920 - TRACE [...MCBLoginServlet:552] - Adding method [Duo
Two-Factor Login]

11:37:29.920 - DEBUG [...MCBLoginServlet:585] - Using submodule with bean
name of [mcb.duo]

…

11:37:41.503 - DEBUG [...MCBLoginServlet:217] - Found idms attribute:
assurance

11:37:41.503 - DEBUG [...MCBLoginServlet:219] - Found [1] values in
attribute.

11:37:41.503 - DEBUG [...MCBLoginServlet:227] - User authenticated with
method [duo]

11:37:41.503 - TRACE [...MCBConfiguration:316] - mtc = [duo]

11:37:41.503 - TRACE [...MCBLoginServlet:234] - Used context = [
https://iam.alaska.edu/trac/wiki/mfa]

11:37:41.504 - TRACE [...MCBConfiguration:340] - Looking for value [
https://iam.alaska.edu/trac/wiki/mfa] in list.

11:37:41.504 - TRACE [...MCBConfiguration:342] - Found value [
https://iam.alaska.edu/trac/wiki/mfa] in list.

11:37:41.504 - DEBUG [...MCBLoginServlet:257] - Used context listed in
valid contexts = [true]

11:37:41.504 - DEBUG [...MCBLoginServlet:266] - Used context for principal
[dabantz] is on the potential allowed list.

11:37:41.504 - TRACE [...MCBConfiguration:413] -   Adding context of
[urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport]

11:37:41.504 - TRACE [...MCBConfiguration:500] -   Adding context of [
https://iam.alaska.edu/trac/wiki/mfa]

11:37:41.504 - TRACE [...MCBConfiguration:433] -  containerWithChildren
[urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport]

11:37:41.504 - TRACE [...MCBConfiguration:433] -  containerWithChildren [
https://iam.alaska.edu/trac/wiki/mfa]

11:37:41.504 - TRACE [...MCBConfiguration:340] - Looking for value [
https://iam.alaska.edu/trac/wiki/mfa] in list.

11:37:41.505 - TRACE [...MCBConfiguration:342] - Found value [
https://iam.alaska.edu/trac/wiki/mfa] in list.

11:37:41.505 - DEBUG [...MCBLoginServlet:271] - Used context listed in
requested contexts = [true]

11:37:41.505 - DEBUG [...MCBLoginServlet:274] - Simple case met. The used
context is in the requested list for principal [dabantz]

11:37:41.505 - TRACE [...MCBConfiguration:450] - Looking for context of [
https://iam.alaska.edu/trac/wiki/mfa] that satisfies a requested.

11:37:41.505 - TRACE [...MCBConfiguration:483] - No match found, returning
null.

11:37:41.505 - DEBUG [...MCBLoginServlet:156] - Authentication result =
[true]
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150707/c715a57d/attachment-0001.html>

More information about the users mailing list