MFA for Specific SPs

[Brian Moon]

Seems I had to take it one step further and add the principals to the
authn/MFA flow as well.  But once I did that, it started working like a
charm.

Thanks!


Brian Moon
Senior System Administrator, Enterprise Systems
Elections & Bylaws Committee Co-Chair, Staff Senate 2017-2018
Santa Clara University
bmoon at scu.edu | (408) 554-4830 <4085544830>

On Wed, Aug 9, 2017 at 4:59 PM, Andrew Morgan <morgan at orst.edu> wrote:

> On Wed, 9 Aug 2017, Brian Moon wrote:
>
> Looks like they might, but cannot say for sure since it's still bombing
>> with the following:
>>
>> 2017-08-09 16:32:11,512 - INFO
>> [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:508] - Profile
>> Action SelectAuthenticationFlow: None of the potential authentication
>> flows
>> can satisfy the request
>> 2017-08-09 16:32:11,513 - WARN
>> [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event
>> occurred while processing the request: RequestUnsupported
>>
>> I get the same thing with the REFEDS value.  From this I just found a
>> thread at
>> http://shibboleth.1660669.n2.nabble.com/Forcing-Duo-by-Servi
>> ce-Provider-td7632287.html,
>> which is exactly what I want to do.  I'll keep digging into that thread
>> and
>> let you know if I find anything with REFEDS.
>>
>
> That's my thread...  :)
>
> Did you configure the rest of Shibboleth to support Duo?  You need to
> modify conf/authn/general-authn.xml (make the classRef match incommon or
> refeds or whatever you use):
>
>         <bean id="authn/Duo" parent="shibboleth.AuthenticationFlow"
>                 p:forcedAuthenticationSupported="true"
>                 p:nonBrowserSupported="false">
>             <!--
>             The list below should be changed to reflect whatever locally-
> or
>             community-defined values are appropriate to represent MFA. It
> is
>             strongly advised that the value not be specific to Duo or any
>             particular technology.
>             -->
>             <property name="supportedPrincipals">
>                 <list>
>                     <bean parent="shibboleth.SAML2AuthnContextClassRef"
>                         c:classRef="http://id.incommon.org/assurance/mfa"
> />
>                     <bean parent="shibboleth.SAML1AuthenticationMethod"
>                         c:method="http://example.org/ac/classes/mfa" />
>                 </list>
>             </property>
>         </bean>
>
>
> You also need to check your logic in conf/authn/mfa-authn-config.xml, of
> course.  But your error suggests it can't find a supported principal for
> your authenticationContextClassRef....
>
>
>         Andy
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170809/2dca25d9/attachment.html>