MFA for Specific SPs

[Andrew Morgan]

On Wed, 9 Aug 2017, Brian Moon wrote:

> Hello all,
>
> I have a need to require MFA for a subset of our SPs, whether the SP
> requests it or not.  To set this up, I have the IdP configured the MFA flow
> to programmatically select the flows, wherein the script looks at the
> requesting party and makes a determination from that on whether to require
> a second factor or not.  The issue I'm running into, though, is that the
> result from the previous execution is being used rather than re-evaluating
> each time.  Following the documentation at
> https://wiki.shibboleth.net/confluence/display/IDP30/MultiFactorAuthnConfiguration#MultiFactorAuthnConfiguration-ReuseoftheEntireauthn/MFAFlowResult(WhenIsaMFANextFlowStrategyExecuted?),
> I have added the following to relying-party.xml:
>
>    <bean id="MfaPrincipal" parent="shibboleth.SAML2AuthnContextClassRef"
>        c:classRef="https://refeds.org/profile/mfa" />
>
>    <bean id="PasswordPrincipal"
> parent="shibboleth.SAML2AuthnContextClassRef"
>
> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"
> />
>
>    <util:list id="shibboleth.RelyingPartyOverrides">
>        <bean parent="RelyingPartyByName" c:relyingPartyIds="
> https://example/sp">
>            <property name="profileConfigurations">
>                <list>
>                    <bean parent="SAML2.SSO"
> p:disallowedFeatures-ref="SAML2.SSO.FEATURE_AUTHNCONTEXT">
>                        <property name="defaultAuthenticationMethods">
>                            <list>
>                                <ref bean="MfaPrincipal" />
>                                <ref bean="PasswordPrincipal" />
>                            </list>
>                        </property>
>                    </bean>
>                    <ref bean="SAML2.Logout" />
>                </list>
>            </property>
>        </bean>
>    </util:list>

Don't put PasswordPrincipal in the defaultAuthenticationMethods list. 
Here is my code:

         <bean parent="RelyingPartyByName" c:relyingPartyIds="http://people.oregonstate.edu/~morgan/simplesaml/module.php/saml/sp/metadata.php/default-sp">
             <property name="profileConfigurations">
                 <list>
                     <bean parent="SAML2.SSO" p:disallowedFeatures-ref="SAML2.SSO.FEATURE_AUTHNCONTEXT" p:securityConfiguration-ref="SHA1SecurityConfig">
                         <property name="defaultAuthenticationMethods">
                             <list>
                                 <ref bean="MFASAML2Principal" />
                             </list>
                         </property>
                     </bean>
                 </list>
             </property>
         </bean>

If you include PasswordPrincipal, then that is an acceptable method of 
authentication too.

 	Andy