Problems getting basic MFA example to work

[Craig Pluchinsky]

Make sure you have the authn/MFA bits in general-authn.xml.  The 
general-authn.xml in the dist directory should have this, so you could 
just copy that section.  You may need to adjust the supportedPrincipals to 
what you support.


-------------------------------
Craig Pluchinsky
IT Services
Indiana University of Pennsylvania
724-357-3327


On Thu, 14 Dec 2017, Oluf Færø wrote:

> Hi,
>
> I am trying to get a basic MFA authentication configuration to work.
>
> In this configuration I would like the MFA configuration to first run the IPAddress flow followed by the Password authentication flow.
>
> In idp.properties I have made the following changes
>
>     idp.authn.flows= MFA
>     idp.authn.flows.initial = MFA
>
> In mfa-authn-config.xml I have made the following configuration of the TransitionMap
>
>    <util:map id="shibboleth.authn.MFA.TransitionMap">
>        <!-- First rule runs the IPAddress login flow. -->
>        <entry key="">
>            <bean parent="shibboleth.authn.MFA.Transition" p:nextFlow="authn/IPAddress" />
>        </entry>
>        <entry key="authn/IPAddress">
>            <bean parent="shibboleth.authn.MFA.Transition" p:nextFlow="authn/Password" />
>        </entry>
>        <!-- An implicit final rule will return whatever the final flow returns. -->
>    </util:map>
>
> But when I use this configuration I get the following message in the log file
>
> 2017-12-14 12:43:17,494 - INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:129] - Profile Action SelectAuthenticationFlow: Moving incomplete flow authn/MFA to intermediate set
> 2017-12-14 12:43:17,495 - INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:294] - Profile Action SelectAuthenticationFlow: No potential flows left to choose from, authentication failed
>
> And my service provider displays the following error message
>
> 	opensaml::FatalProfileException
> 	The system encountered an error at Thu Dec 14 12:51:17 2017
> 	To report this problem, please contact the site administrator at root at localhost.
> 	Please include the following message in any email:
> 	opensaml::FatalProfileException at (https://myidphostname/Shibboleth.sso/SAML2/POST)
>
> 	SAML response reported an IdP error.
>
> 	Error from identity provider:
> 	Status: urn:oasis:names:tc:SAML:2.0:status:Requester
> 	Sub-Status: urn:oasis:names:tc:SAML:2.0:status:AuthnFailed
> 	Message: An error occurred.
>
> What part of the configuration am I missing ?
>
>
> -- 
> For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>