IDP 3.3 MFA flow -- checking to see if an authn context class ref was requested

[Wessel, Keith]

Right, Scott, I already have Password firing first in all cases.

But I'm missing something based on your answer. What you say makes sense and seems like a much cleaner approach than what I had in mind. But how do I check to see if, specifically, the Duo method needs to be used if I'm not looking at specifically requested contexts? I don't want to prompt the user for Duo if the SP didn't ask for the 2nd factor to be performed.

Jim's solution seems to do this, but it seems to go against this cleaner approach that you're suggesting.

Keith

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Monday, December 05, 2016 12:40 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: IDP 3.3 MFA flow -- checking to see if an authn context class ref was requested

On 12/5/16, 1:14 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:

> Trying to set things up such that, in the case that the SP requests Duo and Password (in that order), my IdP can
> handle things intelligently. If Both were requested and the user is eligible for Duo, I want to signal Duo. If both
> were requested and the user isn't Duo eligible, I'll let them through with Password. If the SP didn't request Duo at
> all, I'll let them through with Password. And if the SP only requested Duo, I'll either send them to a Duo flow or to
> another flow which displays an error stating they need to enroll for a Duo token.

You pretty much always want to start by running the Password flow of course, since that's the baseline. Assuming your first factor is always Password anyway.

Then you can branch to a script step and do your checking there.

> First, I see I can use the isAcceptable method (as included in the distributed example) to see if a requested
> method has been satisfied. But I'm curious, in this case, about requested methods that haven't been satisfied -
> namely Duo. How can I get a list of requested authentication context classes? I've looked at the MFA context and
> authentication context in the JavaDocs, but I don't see anything to help me in those.

What you really want to do is check individually whether the method(s) you want to support are or are not satisfied. Don't compare against what was requested. If you do that, you're limiting the request to "exact" whereas my way handles anything.

If you want to handle the most general case, you just run Password and then say "is that good enough?". If you want to go beyond that, you have to enumerate specific types you want to check for but you should still craft it in terms of "does this method satisfy the request?".

> Second, would it be easier for me to not use the MFA flow at all but rather check for Duo eligibility (by checking a
> user's attribute values) inside my duo.vm?

No, that is not easier. It's not even possible, without modifying the flow to resolve attributes. The MFA flow can be scripted to resolve attributes. The Duo flow doesn't do that.

-- Scott


-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net