Requested PasswordProtectedTransport auth context & MCB

[Paul Hethmon]

David,

Some comments inline.

On Jul 7, 2015, at 4:22 PM, IAM David Bantz <dabantz at alaska.edu<mailto:dabantz at alaska.edu>> wrote:

I'm no longer seeing the IdP log error parsing incoming SAML. But I am seeing the following anomaly with MCB and the following requested authn context in the SAML request:

   <samlp:RequestedAuthnContext xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" Comparison="exact">

        <saml:AuthnContextClassRef xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
        </saml:AuthnContextClassRef>

   </samlp:RequestedAuthnContext>

My account requires 2FA based on LDAP attribute; I successfully authN with password + Duo.

Another user with no such LDAP attribute requiring 2FA successfully binds to LDAP, but the MCB rejects the authN as not meeting the requirement.

One of the issues here is that the log snippet below shows the user as having no allowable context values. Saying no allowable values is not the same as saying any value is allowable. The MCB is going to take that zero item list and never find a match.


MCB log snippets for both transactions are at the end of this email.

Presumably some part of the MCB configuration should be changed to allow method password to satisfy the requested context of PasswordProtectedTransport;
a pointer to what needs to change would be appreciated.

Here's what I have in multi-context-broker.xml

    <initialAuthContext requestedOnly="false">

            <context name="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" />

    </initialAuthContext>

and this under authnContexts:

        <context name="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" method="password">

            <allowedContexts>

                <context name="https://iam.alaska.edu/trac/wiki/mfa" />

            </allowedContexts>


        </context>

So you need something like this to allow the “Password” context to be satisfied by the “PasswordProtectedTransport” context:

<context name=“urn:oasis:names:tc:SAML:2.0:ac:classes:Password” method=“password”>
    <allowedContexts>
        <context name=“urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport” />
    </allowedContexts>
</context>



Here are log snippets from the two transactions:


Successful authN via LDAP; no directory attribute requiring 2FA;

then the MCB reports:

11:40:10.888 - DEBUG [...MCBLoginServlet:217] - Found idms attribute: null

11:40:10.888 - DEBUG [...MCBLoginServlet:219] - Found [0] values in attribute.

Right here you’ve told the MCB that this user is not allowed to use any context value. You’ve got to supply something for them to be able to succeed.


corresponding login for dabantz (with 2FA required):

11:37:29.918 - DEBUG [...MCBLoginServlet:217] - Found idms attribute: assurance

11:37:29.918 - DEBUG [...MCBLoginServlet:219] - Found [1] values in attribute.

And this one has a value, so they succeed.

Paul

-----
Paul Hethmon
Chief Software Architect
paul.hethmon at clareitysecurity.com<mailto:paul.hethmon at clareitysecurity.com>


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20150707/0c6cd3ca/attachment.html>