Advice on migrating SPNEGO to MFA-flow

[Philip Brusten]

On 10/01/2017 19:20, Cantor, Scott wrote:
> When I did the Duo flow, I avoided this by authoring it to avoid the 
> creation of a second UsernamePrincipal, I had it create a DuoPrincipal.
Thanks for the tip, I created a seperate principal and now c14n/Simple 
works again on the UserPrincipal set from authn/SPNEGO.

>> Why doesn't the MFA-flow user the principalnames that already have been
>> canonicalized?
> For one thing, there's no requirement that they match. After the merge, you have a totally fresh Subject that could have undergone any amount of manipulation. The final c14n step is just like the end of any login flow, it takes a fresh look at the result and produces the outcome. That might not even be the same as the value(s) that the internal flows produced. It's just layering and retaining flexibility.
>
> Again, optimizations are probably possible to automate more of the cases, but when I'm doing a design this complex, I'm not focused on the common cases sadly, I'm forced to focus on all the exotic ones and make sure it doesn't break things.
Ok, I understand now. It takes time to get your head around :)


As you already predicted, I'm now stuck at when SPNEGO failes for some 
reason (e.g. misonfigured browser)

MFA starts SPNEGO flow, but I cannot catch the event "ReselectFlow", so 
I end up with the event "NoPotentialFlow".

Transition map:
<util:map id="shibboleth.authn.MFA.TransitionMap">
     <entry key="">
         <bean parent="shibboleth.authn.MFA.Transition" 
p:nextFlowStrategy-ref="selectFirstFactor" />
     </entry>

     <entry key="SPNEGONotAvailable">
       <bean parent="shibboleth.authn.MFA.Transition" 
p:nextFlow="authn/Password" />
     </entry>

     <entry key="ReselectFlow">
       <bean parent="shibboleth.authn.MFA.Transition" 
p:nextFlow="authn/Password" />
     </entry>

     <entry key="authn/SPNEGO">
         <bean parent="shibboleth.authn.MFA.Transition" 
p:nextFlowStrategy-ref="checkSecondFactor" />
     </entry>

     <entry key="authn/Password">
         <bean parent="shibboleth.authn.MFA.Transition" 
p:nextFlowStrategy-ref="checkSecondFactor" />
     </entry>

     <!-- An implicit final rule will return whatever the final flow 
returns. -->
</util:map>


idp-process.log:
2017-01-11 11:27:25,024 - DEBUG 
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:338] - 
10.34.165.120|Profile Action SelectAuthenticationFlow: Selecting 
inactive authentication flow authn/MFA
2017-01-11 11:27:25,265 - DEBUG 
[net.shibboleth.idp.authn.impl.PopulateMultiFactorAuthenticationContext:164] 
- 10.34.165.120|Profile Action PopulateMultiFactorAuthenticationContext: 
0 active result(s) extracted for possible reuse
2017-01-11 11:27:25,276 - DEBUG 
[net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:195] 
- 10.34.165.120|Profile Action TransitionMultiFactorAuthentication: 
Applying MFA transition rule to determine initial state
2017-01-11 11:27:25,319 - DEBUG [selectFirstFactor:4] - 
10.34.165.120|Starting selectFirstFactor
2017-01-11 11:27:25,352 - DEBUG [selectFirstFactor:12] - 
10.34.165.120|Check if SPNEGO opt-in was done through cookie: true
2017-01-11 11:27:25,362 - DEBUG [selectFirstFactor:16] - 
10.34.165.120|Check if SPNEGO can be activated: true
2017-01-11 11:27:25,366 - DEBUG [selectFirstFactor:19] - 
10.34.165.120|Opt-in for SPNEGO and activationcondition is set
2017-01-11 11:27:25,367 - DEBUG 
[net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:214] 
- 10.34.165.120|Profile Action TransitionMultiFactorAuthentication: MFA 
flow transition after 'proceed' event to 'authn/SPNEGO' flow
2017-01-11 11:27:25,497 - DEBUG 
[net.shibboleth.idp.authn.spnego.impl.SPNEGOAutoLoginManager:97] - 
10.34.165.120|Auto-login has been disabled.
2017-01-11 11:27:25,595 - DEBUG [org.apache.velocity:100] - 
10.34.165.120|ResourceManager : found spnego-unavailable.vm with loader 
org.apache.velocity.runtime.resource.loader.FileResourceLoader
2017-01-11 11:27:25,886 - WARN 
[net.shibboleth.idp.authn.spnego.impl.SPNEGOAuthnController:224] - 
10.34.165.120|SPNEGO authentication problem signaled by client
2017-01-11 11:27:25,940 - INFO 
[net.shibboleth.idp.authn.impl.ValidateExternalAuthentication:129] - 
10.34.165.120|Profile Action ValidateExternalAuthentication: External 
authentication produced error message: SPNEGONotAvailable
2017-01-11 11:27:25,950 - DEBUG 
[net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:197] 
- 10.34.165.120|Profile Action TransitionMultiFactorAuthentication: 
Applying MFA transition rule to exit state 'authn/SPNEGO'
2017-01-11 11:27:25,951 - DEBUG 
[net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:219] 
- 10.34.165.120|Profile Action TransitionMultiFactorAuthentication: MFA 
flow completing with event 'ReselectFlow'
2017-01-11 11:27:25,958 - INFO 
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:129] - 
10.34.165.120|Profile Action SelectAuthenticationFlow: Moving incomplete 
flow authn/MFA to intermediate set
2017-01-11 11:27:25,958 - DEBUG 
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:255] - 
10.34.165.120|Profile Action SelectAuthenticationFlow: No specific 
Principals requested
2017-01-11 11:27:25,958 - DEBUG 
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:290] - 
10.34.165.120|Profile Action SelectAuthenticationFlow: No usable active 
results available, selecting an inactive flow
2017-01-11 11:27:25,958 - INFO 
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:294] - 
10.34.165.120|Profile Action SelectAuthenticationFlow: No potential 
flows left to choose from, authentication failed
2017-01-11 11:27:25,978 - DEBUG 
[org.opensaml.saml.common.profile.logic.DefaultLocalErrorPredicate:184] 
- 10.34.165.120|Error event NoPotentialFlow will be handled with response

Am I doing something wrong here? As you can see I tried to catch the 
event 'ReselectFlow' in the TransitionMap to set the nextFlow to 
'authn/Password'.

Thx,

Philip