Overriding authentication method for an SP

[Wessel, Keith]

Hello, all,

Our ADFS folks want Duo enabled for their Shib integration. Following the V3 relying party docs, I added this bean to my relying-party.xml:

        <bean parent="RelyingPartyByName" c:relyingPartyIds="http://sts.exchangetest.illinois.edu/adfs/services/trust">
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO" p:defaultAuthenticationMethods="#{'urn:mace:incommon:uiuc.edu:duo'}" />
                </list>
            </property>
        </bean>

And we get a relying party configuration error when they try to log in. Logs aren't telling me much more than that, even with net/shibboleth.idp and org.opensaml.saml turned up to debug.

Is urn:mace:incommon:uiuc.edu:duo a valid authentication method principal if it's what we're using the request and assert MFA? Wondering if that's the right value to be passing to the defaultAuthenticationMethods property.

Thanks,
Keith