MFA for Specific SPs

[Andrew Morgan]

Ah, now that you mention it, I added it to authn/MFA as well.

If I think about, I guess authn/MFA needs to have all the methods it 
supports (it's the initial flow) and authn/Duo has just the 
https://refeds.org/profile/mfa method.

 	Andy


On Wed, 9 Aug 2017, Brian Moon wrote:

> Seems I had to take it one step further and add the principals to the
> authn/MFA flow as well.  But once I did that, it started working like a
> charm.
>
> Thanks!
>
>
> Brian Moon
> Senior System Administrator, Enterprise Systems
> Elections & Bylaws Committee Co-Chair, Staff Senate 2017-2018
> Santa Clara University
> bmoon at scu.edu | (408) 554-4830 <4085544830>
>
> On Wed, Aug 9, 2017 at 4:59 PM, Andrew Morgan <morgan at orst.edu> wrote:
>
>> On Wed, 9 Aug 2017, Brian Moon wrote:
>>
>> Looks like they might, but cannot say for sure since it's still bombing
>>> with the following:
>>>
>>> 2017-08-09 16:32:11,512 - INFO
>>> [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:508] - Profile
>>> Action SelectAuthenticationFlow: None of the potential authentication
>>> flows
>>> can satisfy the request
>>> 2017-08-09 16:32:11,513 - WARN
>>> [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event
>>> occurred while processing the request: RequestUnsupported
>>>
>>> I get the same thing with the REFEDS value.  From this I just found a
>>> thread at
>>> http://shibboleth.1660669.n2.nabble.com/Forcing-Duo-by-Servi
>>> ce-Provider-td7632287.html,
>>> which is exactly what I want to do.  I'll keep digging into that thread
>>> and
>>> let you know if I find anything with REFEDS.
>>>
>>
>> That's my thread...  :)
>>
>> Did you configure the rest of Shibboleth to support Duo?  You need to
>> modify conf/authn/general-authn.xml (make the classRef match incommon or
>> refeds or whatever you use):
>>
>>         <bean id="authn/Duo" parent="shibboleth.AuthenticationFlow"
>>                 p:forcedAuthenticationSupported="true"
>>                 p:nonBrowserSupported="false">
>>             <!--
>>             The list below should be changed to reflect whatever locally-
>> or
>>             community-defined values are appropriate to represent MFA. It
>> is
>>             strongly advised that the value not be specific to Duo or any
>>             particular technology.
>>             -->
>>             <property name="supportedPrincipals">
>>                 <list>
>>                     <bean parent="shibboleth.SAML2AuthnContextClassRef"
>>                         c:classRef="http://id.incommon.org/assurance/mfa"
>> />
>>                     <bean parent="shibboleth.SAML1AuthenticationMethod"
>>                         c:method="http://example.org/ac/classes/mfa" />
>>                 </list>
>>             </property>
>>         </bean>
>>
>>
>> You also need to check your logic in conf/authn/mfa-authn-config.xml, of
>> course.  But your error suggests it can't find a supported principal for
>> your authenticationContextClassRef....
>>
>>
>>         Andy
>> --
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>