Multiple Duo Integrations with distinct principal sets

[Mulchek, Paul]

Thanks for clearing up the util list values as we were having similar troubles with it, good timing. We are also trying to use Multiple Integrations with distinct principle sets and are running into an issue. We can call duo for individual integrations based on authncontextclassRef for the initial mfa calling to Duo. However, when changing authncontextclassRef profiles and trying to reuse the mfa result it is never getting to authn to evaluate the profile giving an error of NoAuthnContext. Reading the documentation on MultiFactorAuthnConfiguration in the Single Sign-On / Reuse section it appears that we are meeting the requirements but obviously we are missing something.


2017-01-09 16:04:23,732 - DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:214] - Profile Action TransitionMultiFactorAuthentication: MFA flow transition after 'proceed' event to 'authn/Duo' flow
2017-01-09 16:04:23,732 - DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:262] - Profile Action TransitionMultiFactorAuthentication: Reusing active result for 'authn/Duo' flow
2017-01-09 16:04:23,732 - DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:197] - Profile Action TransitionMultiFactorAuthentication: Applying MFA transition rule to exit state 'authn/Duo'
2017-01-09 16:04:23,732 - DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:219] - Profile Action TransitionMultiFactorAuthentication: MFA flow completing with event 'proceed'
2017-01-09 16:04:23,779 - WARN [net.shibboleth.idp.authn.impl.FinalizeAuthentication:179] - Profile Action FinalizeAuthentication: Authentication result for flow authn/MFA did not satisfy the request
2017-01-09 16:04:23,810 - WARN [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event occurred while processing the request: RequestUnsupported

Thanks,

Paul M







________________________________
From: users <users-bounces at shibboleth.net> on behalf of Scott Koranda <skoranda at gmail.com>
Sent: Monday, January 9, 2017 2:58:54 PM
To: Shib Users
Subject: Re: Multiple Duo Integrations with distinct principal sets

> > I do not understand how a null context object is
> > happening.
>
> I'm just guessing, but the example script I showed returns
> null if it doesn't find a Duo configuration that "satisfies"
> the request. I think that it must be exhausting the possible
> cases without finding one, and if that was an actual
> possibility, I don't think the general approach here would
> work right.

Sigh. It was, of course, exhausting the possible cases because
I had a typo in the principal string for one of the beans. I
should really define them once and reference them...

Sorry for the noise. The multiple Duo integration/flow works
as expected.

I updated the wiki page with the syntax for the <util:list>
that works.

Thanks,

Scott K
--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net

________________________________
The materials in this message are private and may contain Protected Healthcare Information or other information of a sensitive nature. If you are not the intended recipient, be advised that any unauthorized use, disclosure, copying or the taking of any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error, please immediately notify the sender via telephone or return mail.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170109/db08221e/attachment.html>