MFA for Specific SPs

[Brian Moon]

Looks like they might, but cannot say for sure since it's still bombing
with the following:

2017-08-09 16:32:11,494 - DEBUG
[net.shibboleth.idp.saml.profile.impl.InitializeAuthenticationContext:115]
- Profile Action InitializeAuthenticationContext: Created authentication
context:
AuthenticationContext{initiationInstant=2017-08-09T16:32:11.494-07:00,
isPassive=false, forceAuthn=false, hintedName=null, potentialFlows=[],
activeResults=[], attemptedFlow=null, signaledFlowId=null,
authenticationStateMap={}, resultCacheable=true,
initialAuthenticationResult=null, authenticationResult=null,
completionInstant=1969-12-31T16:00:00.000-08:00}
2017-08-09 16:32:11,494 - DEBUG
[net.shibboleth.idp.saml.saml2.profile.impl.ProcessRequestedAuthnContext:174]
- Profile Action ProcessRequestedAuthnContext: AuthnRequest did not contain
a RequestedAuthnContext, nothing to do
2017-08-09 16:32:11,495 - DEBUG
[net.shibboleth.idp.authn.impl.PopulateAuthenticationContext:200] - Profile
Action PopulateAuthenticationContext: Installed 1 potential authentication
flows into AuthenticationContext
2017-08-09 16:32:11,495 - DEBUG
[net.shibboleth.idp.session.impl.StorageBackedSessionManager:798] -
Performing primary lookup on session ID
7c7d1729659cd20b4aa865fe4a751b4de4fa20ea1e0a6773874da4aeabfdf68b
2017-08-09 16:32:11,496 - DEBUG
[net.shibboleth.idp.session.impl.StorageBackedIdPSession:90] - Updating
expiration of master record for session
7c7d1729659cd20b4aa865fe4a751b4de4fa20ea1e0a6773874da4aeabfdf68b to
2017-08-09T17:32:11.496-07:00
2017-08-09 16:32:11,497 - DEBUG
[net.shibboleth.idp.session.impl.StorageBackedIdPSession:536] - Loading
AuthenticationResult for flow authn/MFA in session
7c7d1729659cd20b4aa865fe4a751b4de4fa20ea1e0a6773874da4aeabfdf68b
2017-08-09 16:32:11,505 - DEBUG
[net.shibboleth.idp.session.impl.ExtractActiveAuthenticationResults:124] -
Profile Action ExtractActiveAuthenticationResults: Authentication result
authn/MFA is active, copying from session
2017-08-09 16:32:11,506 - DEBUG
[net.shibboleth.idp.authn.impl.InitializeRequestedPrincipalContext:163] -
Profile Action InitializeRequestedPrincipalContext: Established
RequestedPrincipalContext with 1 methods
2017-08-09 16:32:11,507 - DEBUG
[net.shibboleth.idp.authn.impl.FilterFlowsByForcedAuthn:53] - Profile
Action FilterFlowsByForcedAuthn: Request does not have forced
authentication requirement, nothing to do
2017-08-09 16:32:11,507 - DEBUG
[net.shibboleth.idp.authn.impl.FilterFlowsByNonBrowserSupport:53] - Profile
Action FilterFlowsByNonBrowserSupport: Request does not have non-browser
requirement, nothing to do
2017-08-09 16:32:11,508 - DEBUG
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:370] - Profile
Action SelectAuthenticationFlow: Specific principals requested with 'exact'
operator: [AuthnContextClassRefPrincipal{authnContextClassRef=
http://id.incommon.org/assurance/mfa}]
2017-08-09 16:32:11,509 - DEBUG
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:477] - Profile
Action SelectAuthenticationFlow: Checking for an inactive flow or active
result compatible with operator 'exact' and principal '
http://id.incommon.org/assurance/mfa'
2017-08-09 16:32:11,510 - DEBUG
[net.shibboleth.idp.authn.principal.PrincipalEvalPredicateFactoryRegistry:82]
- Registry located predicate factory of type
'net.shibboleth.idp.authn.principal.impl.ExactPrincipalEvalPredicateFactory'
for principal type 'class
net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal' and
operator 'exact'
2017-08-09 16:32:11,512 - INFO
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:508] - Profile
Action SelectAuthenticationFlow: None of the potential authentication flows
can satisfy the request
2017-08-09 16:32:11,513 - WARN
[org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event
occurred while processing the request: RequestUnsupported

I get the same thing with the REFEDS value.  From this I just found a
thread at
http://shibboleth.1660669.n2.nabble.com/Forcing-Duo-by-Service-Provider-td7632287.html,
which is exactly what I want to do.  I'll keep digging into that thread and
let you know if I find anything with REFEDS.


Brian Moon
Senior System Administrator, Enterprise Systems
Elections & Bylaws Committee Co-Chair, Staff Senate 2017-2018
Santa Clara University
bmoon at scu.edu | (408) 554-4830 <4085544830>

On Wed, Aug 9, 2017 at 4:24 PM, Andrew Morgan <morgan at orst.edu> wrote:

> On Wed, 9 Aug 2017, Brian Moon wrote:
>
> Thanks!  That certainly helped and has exposed another gap in my
>> knowledge.  How did you define MFASAML2Principal?
>>
>
> In relying-party.xml, I have:
>
>   <bean id="MFASAML2Principal" parent="shibboleth.SAML2AuthnContextClassRef"
> c:classRef="http://id.incommon.org/assurance/mfa" />
>
> Does REFEDS have a class now?  If so, I could use that before we go live
> next week...  :)
>
>
>         Andy
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170809/dde4e22a/attachment.html>