Configure MFA Authentication result to respond according to the request

[Samuel Bristot Loli]

Thanks Andy.

Yes, I have configured, but I'm not using duo. I'm using my own developed
autentication flow.
Is there any other needed configration  to set the MFA authentication
result with   "http://id.incommon.org/assurance/mfa"?

Em 1 de dez de 2017 9:15 PM, "Andrew Morgan" <morgan at orst.edu> escreveu:

> Did you configure the "authn/Duo" bean supportedPrincipals?  Here is mine:
>
>         <bean id="authn/Duo" parent="shibboleth.AuthenticationFlow"
>                 p:forcedAuthenticationSupported="true"
>                 p:nonBrowserSupported="false">
>             <property name="supportedPrincipals">
>                 <list>
>                     <bean parent="shibboleth.SAML2AuthnContextClassRef"
>                         c:classRef="https://refeds.org/profile/mfa" />
>                 </list>
>             </property>
>         </bean>
>
> Note: We use the "https://refeds.org/profile/mfa" authnContextClassRef,
> but you would put "http://id.incommon.org/assurance/mfa", of course.
>
> Thanks,
>         Andy
>
> On Fri, 1 Dec 2017, Samuel Bristot Loli wrote:
>
> Hi,
>>
>> We are using MFA flow. The SP requests MFA to the IDP sending on the
>> request with the 'exact' operator and the principal '
>> http://id.incommon.org/assurance/mfa'.
>> We added supportedPrincipals in general-auth.xml:
>>
>> <bean id="authn/MFA" parent="shibboleth.AuthenticationFlow"
>>                p:passiveAuthenticationSupported="true"
>>                p:forcedAuthenticationSupported="true">
>>            <property name="supportedPrincipals">
>>                <list>
>>                    <bean parent="shibboleth.SAML2AuthnContextClassRef"
>>                        c:classRef="http://id.incommon.org/assurance/mfa"
>> />
>>                    <bean parent="shibboleth.SAML2AuthnContextClassRef"
>>
>> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordP
>> rotectedTransport"
>> />
>>                    <bean parent="shibboleth.SAML2AuthnContextClassRef"
>>
>> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:Password" />
>>                    <bean parent="shibboleth.SAML1AuthenticationMethod"
>>                        c:method="urn:oasis:names:tc:SAML:1.0:am:password"
>> />
>>                    <bean parent="shibboleth.SAML2AuthnContextClassRef"
>>                        c:classRef="urn:oasis:names:tc:SAML:2.0:assertion"
>> />
>>                </list>
>>            </property>
>>        </bean>
>>
>> The first flow  and second flow  are executed, the MFA flow is completed
>> successfully, but the response we have is:
>> "Authentication result for auth flow/MFA did not satisfy the request"
>> How to configure the MFA Authentication result to respond according to the
>> request ('http://id.incommon.org/assurance/mfa') ?
>>
>> Logs:
>>
>>
>> 2017-12-01 18:38:56,056 - DEBUG
>> [net.shibboleth.idp.authn.impl.FinalizeMultiFactorAuthentication:193] -
>> Profile Action FinalizeMultiFactorAuthentication: MFA complete, pr
>> oducing merged result
>> 2017-12-01 18:38:56,094 - DEBUG
>> [net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext:79]
>> -
>> Profile Action PopulateSubjectCanonicalizationContext: Install
>> ing 2 canonicalization flows into SubjectCanonicalizationContext
>> 2017-12-01 18:38:56,095 - DEBUG
>> [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] -
>> Profile Action SelectSubjectCanonicalizationFlow: Checking canonic
>> alization flow c14n/x500 for applicability...
>> 2017-12-01 18:38:56,096 - DEBUG
>> [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:106] -
>> Profile Action SelectSubjectCanonicalizationFlow: Canonicalization
>> flow c14n/x500 was not applicable to this request
>> 2017-12-01 18:38:56,096 - DEBUG
>> [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] -
>> Profile Action SelectSubjectCanonicalizationFlow: Checking canonic
>> alization flow c14n/simple for applicability...
>> 2017-12-01 18:38:56,096 - DEBUG
>> [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:83] -
>> Profile Action SelectSubjectCanonicalizationFlow: Selecting canonic
>> alization flow c14n/simple
>> 2017-12-01 18:38:56,097 - DEBUG
>> [net.shibboleth.idp.authn.AbstractSubjectCanonicalizationAction:226] -
>> Profile Action SimpleSubjectCanonicalization: trimming whitespace o
>> f input string 'aluno'
>> 2017-12-01 18:38:56,155 - DEBUG
>> [net.shibboleth.idp.session.impl.DetectIdentitySwitch:148] - Profile
>> Action
>> DetectIdentitySwitch: No previous session found, nothing to do
>> 2017-12-01 18:38:56,200 - DEBUG
>> [net.shibboleth.idp.authn.impl.FinalizeAuthentication:137] - Profile
>> Action
>> FinalizeAuthentication: Canonical principal name was establish
>> ed as 'aluno'
>> 2017-12-01 18:38:56,204 - DEBUG
>> [net.shibboleth.idp.authn.impl.FinalizeAuthentication:242] - Profile
>> Action
>> FinalizeAuthentication: Checking result for compatibility with
>> operator 'exact' and principal 'http://id.incommon.org/assurance/mfa'
>> 2017-12-01 18:38:56,205 - DEBUG
>> [net.shibboleth.idp.authn.principal.PrincipalEvalPredicateFa
>> ctoryRegistry:82]
>> - Registry located predicate factory of type 'net.shibboleth
>> .idp.authn.principal.impl.ExactPrincipalEvalPredicateFactory' for
>> principal
>> type 'class
>> net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal'
>> and
>> operato
>> r 'exact'
>> 2017-12-01 18:38:56,206 - WARN
>> [net.shibboleth.idp.authn.impl.FinalizeAuthentication:179] - Profile
>> Action
>> FinalizeAuthentication: Authentication result for flow authn/MF
>> A did not satisfy the request
>> 2017-12-01 18:38:56,236 - WARN
>> [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event
>> occurred while processing the request: RequestUnsupported
>>
>> --
> For Consortium Member technical support, see
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171203/cab715ed/attachment.html>