Configure MFA Authentication result to respond according to the request

[Andrew Morgan]

Did you configure the "authn/Duo" bean supportedPrincipals?  Here is mine:

         <bean id="authn/Duo" parent="shibboleth.AuthenticationFlow"
                 p:forcedAuthenticationSupported="true"
                 p:nonBrowserSupported="false">
             <property name="supportedPrincipals">
                 <list>
                     <bean parent="shibboleth.SAML2AuthnContextClassRef"
                         c:classRef="https://refeds.org/profile/mfa" />
                 </list>
             </property>
         </bean>

Note: We use the "https://refeds.org/profile/mfa" authnContextClassRef, 
but you would put "http://id.incommon.org/assurance/mfa", of course.

Thanks,
 	Andy

On Fri, 1 Dec 2017, Samuel Bristot Loli wrote:

> Hi,
>
> We are using MFA flow. The SP requests MFA to the IDP sending on the
> request with the 'exact' operator and the principal '
> http://id.incommon.org/assurance/mfa'.
> We added supportedPrincipals in general-auth.xml:
>
> <bean id="authn/MFA" parent="shibboleth.AuthenticationFlow"
>                p:passiveAuthenticationSupported="true"
>                p:forcedAuthenticationSupported="true">
>            <property name="supportedPrincipals">
>                <list>
>                    <bean parent="shibboleth.SAML2AuthnContextClassRef"
>                        c:classRef="http://id.incommon.org/assurance/mfa" />
>                    <bean parent="shibboleth.SAML2AuthnContextClassRef"
>
> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"
> />
>                    <bean parent="shibboleth.SAML2AuthnContextClassRef"
>
> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:Password" />
>                    <bean parent="shibboleth.SAML1AuthenticationMethod"
>                        c:method="urn:oasis:names:tc:SAML:1.0:am:password"
> />
>                    <bean parent="shibboleth.SAML2AuthnContextClassRef"
>                        c:classRef="urn:oasis:names:tc:SAML:2.0:assertion"
> />
>                </list>
>            </property>
>        </bean>
>
> The first flow  and second flow  are executed, the MFA flow is completed
> successfully, but the response we have is:
> "Authentication result for auth flow/MFA did not satisfy the request"
> How to configure the MFA Authentication result to respond according to the
> request ('http://id.incommon.org/assurance/mfa') ?
>
> Logs:
>
>
> 2017-12-01 18:38:56,056 - DEBUG
> [net.shibboleth.idp.authn.impl.FinalizeMultiFactorAuthentication:193] -
> Profile Action FinalizeMultiFactorAuthentication: MFA complete, pr
> oducing merged result
> 2017-12-01 18:38:56,094 - DEBUG
> [net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext:79] -
> Profile Action PopulateSubjectCanonicalizationContext: Install
> ing 2 canonicalization flows into SubjectCanonicalizationContext
> 2017-12-01 18:38:56,095 - DEBUG
> [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] -
> Profile Action SelectSubjectCanonicalizationFlow: Checking canonic
> alization flow c14n/x500 for applicability...
> 2017-12-01 18:38:56,096 - DEBUG
> [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:106] -
> Profile Action SelectSubjectCanonicalizationFlow: Canonicalization
> flow c14n/x500 was not applicable to this request
> 2017-12-01 18:38:56,096 - DEBUG
> [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] -
> Profile Action SelectSubjectCanonicalizationFlow: Checking canonic
> alization flow c14n/simple for applicability...
> 2017-12-01 18:38:56,096 - DEBUG
> [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:83] -
> Profile Action SelectSubjectCanonicalizationFlow: Selecting canonic
> alization flow c14n/simple
> 2017-12-01 18:38:56,097 - DEBUG
> [net.shibboleth.idp.authn.AbstractSubjectCanonicalizationAction:226] -
> Profile Action SimpleSubjectCanonicalization: trimming whitespace o
> f input string 'aluno'
> 2017-12-01 18:38:56,155 - DEBUG
> [net.shibboleth.idp.session.impl.DetectIdentitySwitch:148] - Profile Action
> DetectIdentitySwitch: No previous session found, nothing to do
> 2017-12-01 18:38:56,200 - DEBUG
> [net.shibboleth.idp.authn.impl.FinalizeAuthentication:137] - Profile Action
> FinalizeAuthentication: Canonical principal name was establish
> ed as 'aluno'
> 2017-12-01 18:38:56,204 - DEBUG
> [net.shibboleth.idp.authn.impl.FinalizeAuthentication:242] - Profile Action
> FinalizeAuthentication: Checking result for compatibility with
> operator 'exact' and principal 'http://id.incommon.org/assurance/mfa'
> 2017-12-01 18:38:56,205 - DEBUG
> [net.shibboleth.idp.authn.principal.PrincipalEvalPredicateFactoryRegistry:82]
> - Registry located predicate factory of type 'net.shibboleth
> .idp.authn.principal.impl.ExactPrincipalEvalPredicateFactory' for principal
> type 'class
> net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal' and
> operato
> r 'exact'
> 2017-12-01 18:38:56,206 - WARN
> [net.shibboleth.idp.authn.impl.FinalizeAuthentication:179] - Profile Action
> FinalizeAuthentication: Authentication result for flow authn/MF
> A did not satisfy the request
> 2017-12-01 18:38:56,236 - WARN
> [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event
> occurred while processing the request: RequestUnsupported
>