IDP 3.3 MFA flow -- working example

[Sheldon, Nathan I]

Hi Joe and/or Scott.

I’m trying to get Duo working on a clean Shibboleth IdP 3.3 install (in a development environment for now) and am stumped as to why the IdP isn’t sending me to the duo web flow after successful authentication.  I’m hoping you can provide a missing link that I’m obviously missing somewhere.

Here’s a summary of the files I’ve edited in the /opt/shibboleth-idp/conf directory.

——
attribute-filter.xml (to enable SSO testing)
attribute-resolver.xml (“ “ ")
metadata-providers.xml (“ “ “)
relying-party.xml (“ “ “)

logback.xml (Modified to enable DEBUG level logging for most logging).

idp.properties (typical install changes for entityID and scope plus…)
modified property to idp.authn.flows = Password|Duo|MFA
modified properties to enable SLO.
ensured that idp.additionalProperties includes /conf/authn/duo.properties

ldap.properties (typical install changes for authenticated attribute resolution)

authn/duo.properties
modified properties idp.duo.apiHost, idp.udo.applicationKey, idp.duo.integrationKey, and idp.duo.secretKey to match those provided in the Duo admin web console.

authn/general-authn.xml
replaced c:classRef="http://example.org/ac/classes/mfa" /> with c:classRef="http://id.incommon.org/assurance/mfa" />
replaced c:method="http://example.org/ac/classes/mfa" /> with c:method="http://id.incommon.org/assurance/mfa" />

authn/jaas.config (Modified to work with our multiple AD LDAP proxies)

authn/mfa-authn-config.xml (Made all the modifications Scott described in his previous message in this thread).

authn/password-authn-config.xml
uncommented <import resource="jaas-authn-config.xml" />
commented out <import resource="ldap-authn-config.xml" />
——

Authentication works, and after successful authentication, I’m presented with the attribute release consent form.  Consenting to the release correctly redirects to the SP and passes the SAML response.  SSO succeeds.  However, I’m never presented with a Duo authentication request.  Logs don’t show any Duo flow activity other than upon initial Shibboleth IdP startup indicating that the flow is registered.

Is something needed in the duo-authn-config.xml file?  I didn’t see any documentation that specifically said that needed to be edited in order to enable it unless you wanted custom conditions (which I don’t, yet anyway).

Regards,
Nathan
----
Nathan Sheldon
IAM Support Engineer
    Identity and Access Management,
    Information Technology Services
University of California, San Francisco





-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170117/3f8f5b19/attachment-0001.html>