MFA for Specific SPs

[Andrew Morgan]

On Wed, 9 Aug 2017, Brian Moon wrote:

> Looks like they might, but cannot say for sure since it's still bombing
> with the following:
>
> 2017-08-09 16:32:11,512 - INFO
> [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:508] - Profile
> Action SelectAuthenticationFlow: None of the potential authentication flows
> can satisfy the request
> 2017-08-09 16:32:11,513 - WARN
> [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event
> occurred while processing the request: RequestUnsupported
>
> I get the same thing with the REFEDS value.  From this I just found a
> thread at
> http://shibboleth.1660669.n2.nabble.com/Forcing-Duo-by-Service-Provider-td7632287.html,
> which is exactly what I want to do.  I'll keep digging into that thread and
> let you know if I find anything with REFEDS.

That's my thread...  :)

Did you configure the rest of Shibboleth to support Duo?  You need to 
modify conf/authn/general-authn.xml (make the classRef match incommon or 
refeds or whatever you use):

         <bean id="authn/Duo" parent="shibboleth.AuthenticationFlow"
                 p:forcedAuthenticationSupported="true"
                 p:nonBrowserSupported="false">
             <!--
             The list below should be changed to reflect whatever locally- or
             community-defined values are appropriate to represent MFA. It is
             strongly advised that the value not be specific to Duo or any
             particular technology.
             -->
             <property name="supportedPrincipals">
                 <list>
                     <bean parent="shibboleth.SAML2AuthnContextClassRef"
                         c:classRef="http://id.incommon.org/assurance/mfa" />
                     <bean parent="shibboleth.SAML1AuthenticationMethod"
                         c:method="http://example.org/ac/classes/mfa" />
                 </list>
             </property>
         </bean>


You also need to check your logic in conf/authn/mfa-authn-config.xml, of 
course.  But your error suggests it can't find a supported principal for 
your authenticationContextClassRef....

 	Andy