MFA for Specific SPs

[Cantor, Scott]

On 8/9/17, 8:06 PM, "users on behalf of Brian Moon" <users-bounces at shibboleth.net on behalf of bmoon at scu.edu> wrote:

> Seems I had to take it one step further and add the principals to the authn/MFA flow as well.  But once I did that, it started
> working like a charm.

That's documented, but it's buried inside the page, I'll see what I can do about that. The documentation needs a bit of a top-level "summary" of what has to get configured, it doesn't present that well right now.

-- Scott





















On Wed, Aug 9, 2017 at 4:59 PM, Andrew Morgan 
<morgan at orst.edu> wrote:

On Wed, 9 Aug 2017, Brian Moon wrote:

Looks like they might, but cannot say for sure since it's still bombing
with the following:

2017-08-09 16:32:11,512 - INFO
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:508] - Profile
Action SelectAuthenticationFlow: None of the potential authentication flows
can satisfy the request
2017-08-09 16:32:11,513 - WARN
[org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event
occurred while processing the request: RequestUnsupported

I get the same thing with the REFEDS value.  From this I just found a
thread at
http://shibboleth.1660669.n2.nabble.com/Forcing-Duo-by-Service-Provider-td7632287.html,
which is exactly what I want to do.  I'll keep digging into that thread and
let you know if I find anything with REFEDS.



That's my thread...  :)

Did you configure the rest of Shibboleth to support Duo?  You need to modify conf/authn/general-authn.xml (make the classRef match incommon or refeds or whatever you use):

        <bean id="authn/Duo" parent="shibboleth.AuthenticationFlow"
                p:forcedAuthenticationSupported="true"
                p:nonBrowserSupported="false">
            <!--
            The list below should be changed to reflect whatever locally- or
            community-defined values are appropriate to represent MFA. It is
            strongly advised that the value not be specific to Duo or any
            particular technology.
            -->
            <property name="supportedPrincipals">
                <list>
                    <bean parent="shibboleth.SAML2AuthnContextClassRef"
                        c:classRef="http://id.incommon.org/assurance/mfa" />
                    <bean parent="shibboleth.SAML1AuthenticationMethod"
                        c:method="http://example.org/ac/classes/mfa" />
                </list>
            </property>
        </bean>


You also need to check your logic in conf/authn/mfa-authn-config.xml, of course.  But your error suggests it can't find a supported principal for your authenticationContextClassRef....


        Andy
-- 
To unsubscribe from this list send an email to 
users-unsubscribe at shibboleth.net <mailto:users-unsubscribe at shibboleth.net>