requiring 2FA for a service (Shibboleth 2 & MCB) (update)

[IAM David Bantz]

In the relying-party.xml config for the SP I want to use 2FA,
I set defaultAuthenticationMethod to designate our Duo 2FA context rather
than usual PPT:

from:
    defaultAuthenticationMethod=
"urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"
to:
    defaultAuthenticationMethod="https://iam.alaska.edu/trac/wiki/mfa"

Unfortunately, users not explicitly provisioned Duo 2FA context simply
authenticate with password instead.

Is there some MFB configuration that could avoid that - could enforce 2FA
or deny if the user cannot use 2FA?

[AWS alas is accessed via unsolicited SSO request.  While I can write the
request to ask for 2FA context, it would of course be trivial for someone
to write their own request dropping that part of the request and thus gain
access with just PPT.  So I need some way of
enforcing use of 2FA. If I cannot do that with some combination of
metadata, relying-party, and mcb configuration, I'm thinking I
could conditionally release required attributes based on
AuthenticationMethodString in the attribute-filter.xml; that would drop the
user into an AWS session, but with no roles to accomplish anything.]

David Bantz

On Thu, Oct 15, 2015 at 4:13 PM, Paul Caskey <pcaskey at internet2.edu> wrote:

> We never got the method of setting defaultAuthenticationMethod in
> relying-party.xml to work correctly (even with what we thought was the
> latest version), so I can’t say for sure.
>
>
>
>
>
>
>
> *From:* users [mailto:users-bounces at shibboleth.net] *On Behalf Of *David
> Walker
> *Sent:* Thursday, October 15, 2015 6:50 PM
> *To:* users at shibboleth.net
> *Subject:* Re: requiring 2FA for a service (Shibboleth 2 & MCB)
>
>
>
> The current version of the MCB (for Shib 2) should be treating the
> defaultAuthenticationMethod in relying-party.xml as if it were a context
> requested by the SP, so if you set that to a context requiring MFA, it
> should do what you want.  What I don't remember (and the GitHub issue below
> doesn't illuminate) is whether it will override an explicit request from
> the SP or if it's merely a default when the SP requests no context.  Paul,
> if you're watching, do you remember?
>
> By the way, this functionality was not in the initial release; see
> https://github.com/Internet2/Shibboleth-Multi-Context-Broker/issues/11
> for details.
>
> David
>
> On 10/14/2015 07:02 PM, Cantor, Scott wrote:
>
> On 10/14/15, 9:51 PM, "users on behalf of IAM David Bantz" <users-bounces at shibboleth.net on behalf of dabantz at alaska.edu> <users-bounces at shibboleth.netonbehalfofdabantz@alaska.edu> wrote:
>
>
>
>
>
>
>
> Seems it should be possible, setting the defaultAuthenticationMethod for this service in relying-party.xml
>
>
>
> That's nominally correct, but in V2 that isn't really quite saying that it requires that method. That tells it what to do in the absence of any other decision, but it has no way of enforcing what happened before it finishes up. I don't know if the MCB changes that, I guess it probably does.
>
>
>
> -- Scott
>
>
>
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20151016/4fd09f7c/attachment.html>