Configure MFA Authentication result to respond according to the request

[Samuel Bristot Loli]

Hi,

We are using MFA flow. The SP requests MFA to the IDP sending on the
request with the 'exact' operator and the principal '
http://id.incommon.org/assurance/mfa'.
We added supportedPrincipals in general-auth.xml:

<bean id="authn/MFA" parent="shibboleth.AuthenticationFlow"
                p:passiveAuthenticationSupported="true"
                p:forcedAuthenticationSupported="true">
            <property name="supportedPrincipals">
                <list>
                    <bean parent="shibboleth.SAML2AuthnContextClassRef"
                        c:classRef="http://id.incommon.org/assurance/mfa" />
                    <bean parent="shibboleth.SAML2AuthnContextClassRef"

c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"
/>
                    <bean parent="shibboleth.SAML2AuthnContextClassRef"

c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:Password" />
                    <bean parent="shibboleth.SAML1AuthenticationMethod"
                        c:method="urn:oasis:names:tc:SAML:1.0:am:password"
/>
                    <bean parent="shibboleth.SAML2AuthnContextClassRef"
                        c:classRef="urn:oasis:names:tc:SAML:2.0:assertion"
/>
                </list>
            </property>
        </bean>

The first flow  and second flow  are executed, the MFA flow is completed
successfully, but the response we have is:
"Authentication result for auth flow/MFA did not satisfy the request"
How to configure the MFA Authentication result to respond according to the
request ('http://id.incommon.org/assurance/mfa') ?

Logs:


2017-12-01 18:38:56,056 - DEBUG
[net.shibboleth.idp.authn.impl.FinalizeMultiFactorAuthentication:193] -
Profile Action FinalizeMultiFactorAuthentication: MFA complete, pr
oducing merged result
2017-12-01 18:38:56,094 - DEBUG
[net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext:79] -
Profile Action PopulateSubjectCanonicalizationContext: Install
ing 2 canonicalization flows into SubjectCanonicalizationContext
2017-12-01 18:38:56,095 - DEBUG
[net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] -
Profile Action SelectSubjectCanonicalizationFlow: Checking canonic
alization flow c14n/x500 for applicability...
2017-12-01 18:38:56,096 - DEBUG
[net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:106] -
Profile Action SelectSubjectCanonicalizationFlow: Canonicalization
 flow c14n/x500 was not applicable to this request
2017-12-01 18:38:56,096 - DEBUG
[net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] -
Profile Action SelectSubjectCanonicalizationFlow: Checking canonic
alization flow c14n/simple for applicability...
2017-12-01 18:38:56,096 - DEBUG
[net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:83] -
Profile Action SelectSubjectCanonicalizationFlow: Selecting canonic
alization flow c14n/simple
2017-12-01 18:38:56,097 - DEBUG
[net.shibboleth.idp.authn.AbstractSubjectCanonicalizationAction:226] -
Profile Action SimpleSubjectCanonicalization: trimming whitespace o
f input string 'aluno'
2017-12-01 18:38:56,155 - DEBUG
[net.shibboleth.idp.session.impl.DetectIdentitySwitch:148] - Profile Action
DetectIdentitySwitch: No previous session found, nothing to do
2017-12-01 18:38:56,200 - DEBUG
[net.shibboleth.idp.authn.impl.FinalizeAuthentication:137] - Profile Action
FinalizeAuthentication: Canonical principal name was establish
ed as 'aluno'
2017-12-01 18:38:56,204 - DEBUG
[net.shibboleth.idp.authn.impl.FinalizeAuthentication:242] - Profile Action
FinalizeAuthentication: Checking result for compatibility with
 operator 'exact' and principal 'http://id.incommon.org/assurance/mfa'
2017-12-01 18:38:56,205 - DEBUG
[net.shibboleth.idp.authn.principal.PrincipalEvalPredicateFactoryRegistry:82]
- Registry located predicate factory of type 'net.shibboleth
.idp.authn.principal.impl.ExactPrincipalEvalPredicateFactory' for principal
type 'class
net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal' and
operato
r 'exact'
2017-12-01 18:38:56,206 - WARN
[net.shibboleth.idp.authn.impl.FinalizeAuthentication:179] - Profile Action
FinalizeAuthentication: Authentication result for flow authn/MF
A did not satisfy the request
2017-12-01 18:38:56,236 - WARN
[org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event
occurred while processing the request: RequestUnsupported
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171201/3f7ba1e7/attachment.html>