MFA for Specific SPs

[Brian Moon]

Thanks!  That certainly helped and has exposed another gap in my
knowledge.  How did you define MFASAML2Principal?


Brian Moon
Senior System Administrator, Enterprise Systems
Elections & Bylaws Committee Co-Chair, Staff Senate 2017-2018
Santa Clara University
bmoon at scu.edu | (408) 554-4830 <4085544830>

On Wed, Aug 9, 2017 at 3:52 PM, Andrew Morgan <morgan at orst.edu> wrote:

> On Wed, 9 Aug 2017, Brian Moon wrote:
>
> Hello all,
>>
>> I have a need to require MFA for a subset of our SPs, whether the SP
>> requests it or not.  To set this up, I have the IdP configured the MFA
>> flow
>> to programmatically select the flows, wherein the script looks at the
>> requesting party and makes a determination from that on whether to require
>> a second factor or not.  The issue I'm running into, though, is that the
>> result from the previous execution is being used rather than re-evaluating
>> each time.  Following the documentation at
>> https://wiki.shibboleth.net/confluence/display/IDP30/MultiFa
>> ctorAuthnConfiguration#MultiFactorAuthnConfiguration-Reuseof
>> theEntireauthn/MFAFlowResult(WhenIsaMFANextFlowStrategyExecuted?),
>> I have added the following to relying-party.xml:
>>
>>    <bean id="MfaPrincipal" parent="shibboleth.SAML2AuthnContextClassRef"
>>        c:classRef="https://refeds.org/profile/mfa" />
>>
>>    <bean id="PasswordPrincipal"
>> parent="shibboleth.SAML2AuthnContextClassRef"
>>
>> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordP
>> rotectedTransport"
>> />
>>
>>    <util:list id="shibboleth.RelyingPartyOverrides">
>>        <bean parent="RelyingPartyByName" c:relyingPartyIds="
>> https://example/sp">
>>            <property name="profileConfigurations">
>>                <list>
>>                    <bean parent="SAML2.SSO"
>> p:disallowedFeatures-ref="SAML2.SSO.FEATURE_AUTHNCONTEXT">
>>                        <property name="defaultAuthenticationMethods">
>>                            <list>
>>                                <ref bean="MfaPrincipal" />
>>                                <ref bean="PasswordPrincipal" />
>>                            </list>
>>                        </property>
>>                    </bean>
>>                    <ref bean="SAML2.Logout" />
>>                </list>
>>            </property>
>>        </bean>
>>    </util:list>
>>
>
> Don't put PasswordPrincipal in the defaultAuthenticationMethods list. Here
> is my code:
>
>         <bean parent="RelyingPartyByName" c:relyingPartyIds="http://peop
> le.oregonstate.edu/~morgan/simplesaml/module.php/saml/sp/
> metadata.php/default-sp">
>             <property name="profileConfigurations">
>                 <list>
>                     <bean parent="SAML2.SSO" p:disallowedFeatures-ref="SAML2.SSO.FEATURE_AUTHNCONTEXT"
> p:securityConfiguration-ref="SHA1SecurityConfig">
>                         <property name="defaultAuthenticationMethods">
>                             <list>
>                                 <ref bean="MFASAML2Principal" />
>                             </list>
>                         </property>
>                     </bean>
>                 </list>
>             </property>
>         </bean>
>
> If you include PasswordPrincipal, then that is an acceptable method of
> authentication too.
>
>         Andy
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170809/32d8a734/attachment-0001.html>