idp 3.0 MFA/DUO questions.

[Mathis, Bradley]

Thank you so much. This gives me a good starting point.


Brad Mathis
Principal Systems Analyst
Pima Community College
IT - Technical Services
520.206.4826
bmathis at pima.edu








On Thu, Dec 21, 2017 at 7:57 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:

> > At the moment I get a second factor (DUO) prompt for everything.  I think
> > that's due to how I have the shibboleth.authn.MFA.TransitionMap
> > configured
>
> You are explicitly telling it to do that. There's no "think" involved.
>
> > Eventually we will have about 10 to 15 SP's  some will need MFA and some
> > won't. Some will be CAS protocol and some won't (not sure that matters).
>
> It matters in that you can't tell the CAS SPs to request what they want.
>
> > Questions:
> >
> > 1. Where/how to define the logic of what apps/SP's need a second factor
> > and which ones don't?
>
> That depends on your end game. If you want a permanent "some do, some
> don't" environment, then have as many SAML SPs as possible do it on their
> own, ask for that they want and enforce it. Use the "isAcceptable()" method
> on the MultiFactorAuthenticationContext object in the tree to test
> whether to bother adding Duo, which is in the example provided with the
> software.
>
> For the SPs that can't request it, or are using CAS, set the
> defaultAuthenticationMethods property to inject a requirement on their
> profile configuration bean(s) in a relying party override and block them
> from requesting something different. That's outlined in the documentation
> on that property, which is the second hit from a wiki search,
> ProfileConfiguration-Authentication.
>
> If your end game is "eventually on for everything", I would just move
> there as quickly as possible by picking a couple of big apps that will
> cover your population, force those on with a relying party override, and
> once everybody's ready, just flip the switch. If you must take years with
> it, I'd still focus on turning them on at the IdP end.
>
> Either way the MFA logic is trivial: do Password, if mfaCtx.isAcceptable()
> then done, else do Duo.
>
> > 2. Eventually we will want to use some type of opt-in for apps that don't
> > require MFA, we are hoping to be able to do that based on and attruibute
> we
> > set in ldap is that possible? ( I think it is )
>
> I wouldn't if your end game is all on, it's just wasted time, but that's
> what the example that ships with the software does, but you want to do
> opt-in for everything or you're going to have ordering issues that will
> make it difficult to get the results you're expecting because the logic
> only runs when the system doesn't bypass it for SSO.
>
> -- Scott
>
> --
> For Consortium Member technical support, see https://wiki.shibboleth.net/
> confluence/x/coFAAg
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20171221/3e79421c/attachment.html>