MFA for Specific SPs

[Brian Moon]

Hello all,

I have a need to require MFA for a subset of our SPs, whether the SP
requests it or not.  To set this up, I have the IdP configured the MFA flow
to programmatically select the flows, wherein the script looks at the
requesting party and makes a determination from that on whether to require
a second factor or not.  The issue I'm running into, though, is that the
result from the previous execution is being used rather than re-evaluating
each time.  Following the documentation at
https://wiki.shibboleth.net/confluence/display/IDP30/MultiFactorAuthnConfiguration#MultiFactorAuthnConfiguration-ReuseoftheEntireauthn/MFAFlowResult(WhenIsaMFANextFlowStrategyExecuted?),
I have added the following to relying-party.xml:

    <bean id="MfaPrincipal" parent="shibboleth.SAML2AuthnContextClassRef"
        c:classRef="https://refeds.org/profile/mfa" />

    <bean id="PasswordPrincipal"
parent="shibboleth.SAML2AuthnContextClassRef"

c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"
/>

    <util:list id="shibboleth.RelyingPartyOverrides">
        <bean parent="RelyingPartyByName" c:relyingPartyIds="
https://example/sp">
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO"
p:disallowedFeatures-ref="SAML2.SSO.FEATURE_AUTHNCONTEXT">
                        <property name="defaultAuthenticationMethods">
                            <list>
                                <ref bean="MfaPrincipal" />
                                <ref bean="PasswordPrincipal" />
                            </list>
                        </property>
                    </bean>
                    <ref bean="SAML2.Logout" />
                </list>
            </property>
        </bean>
    </util:list>

I have also explicitly set idp.authn.favorSSO to false in idp.properties.
I'm not sure if it makes a difference here, but I have idp.authn.flows set
to "MFA" (I also tried setting it to "Password|MFA", but that did not seem
to help).

So, I have two questions:

   1. Am I going about this the proper way, or is there a better way for
   the IdP to require MFA on some SPs, but not all?
   2. If this is the best way to approach this, what else should I be
   looking at to force it to re-run the script?

Thanks!

Brian Moon
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170809/4018fe35/attachment.html>