IdP3 Force Authentication Context for select CAS services

[O'Dowd, Josh]

> It does and that's the method that we use to selectively enable/disable
> 2FA for select services. I would recommend defining a "2fa" group
> and tag those services in your ServiceRegistry bean, then you can use
> a RelyingPartyByGroup strategy to enable it for a number of services.

I have attempted this but I am not having any luck with getting the service group recognized by the RelyingPartyByGroup strategy triggered.  Here is what I have currently:

.. conf/cas-protocol.xml:
                <bean id="cas.serviceRegistry"
          class="net.shibboleth.idp.cas.service.PatternServiceRegistry">
        <property name="definitions">
            <list>
                <!-- 2FA Services -->
                <bean class="net.shibboleth.idp.cas.service.ServiceDefinition"
                      c:regex="{some regex for service match}"
                      p:group="2FA” />
                …


.. conf/relying-party.xml:
                    <!-- Custom Profile for Duo 2FA group -->
                    <bean id="CAS.LoginConfiguration.duo" parent="CAS.LoginConfiguration">
                                <property name="defaultAuthenticationMethods">
                                                <list>
                                                                <bean parent="shibboleth.SAML2AuthnContextClassRef"
                                                                                c:classRef="http://www.duosecurity.com/" />
                                                                <bean parent="shibboleth.SAML2AuthnContextClassRef"
                                                                                c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" />
                                                </list>
                                </property>
                    </bean>

…

    <util:list id="shibboleth.RelyingPartyOverrides">
                <bean parent="RelyingPartyByGroup" c:groupNames="2FA">
                                <property name="profileConfigurations">
                                                <list>
                                                                <ref bean="CAS.LoginConfiguration.duo" />
                                                                <ref bean="CAS.ValidateConfiguration" />
                                                </list>
                                </property>
                </bean>
…

The behavior when logging in with a matching CAS service is that of the default relying party, not the “byGroup” RP; it does not seem to be group-matching on the “2FA” grouping.  I am sure I am not “tagging” the service correctly…

Any help, or an example, thanks.

Josh


From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Marvin Addison
Sent: Tuesday, August 2, 2016 6:26 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: IdP3 Force Authentication Context for select CAS services

On Mon, Aug 1, 2016 at 4:53 PM Cantor, Scott <cantor.2 at osu.edu<mailto:cantor.2 at osu.edu>> wrote:
The IdP can default in the form of authentication to use based on a RelyingParty override, see the defaultAuthenticationMethods property on any of the SSO profile configurations. The CAS login config should have that property.

It does and that's the method that we use to selectively enable/disable 2FA for select services. I would recommend defining a "2fa" group and tag those services in your ServiceRegistry bean, then you can use a RelyingPartyByGroup strategy to enable it for a number of services.

M

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160803/9d02e3cf/attachment-0001.html>