IDP 3.3 MFA flow -- working example

[Sheldon, Nathan I]

Thanks Scott.

That fixed the issue. I’d like to suggest adding a note about the need to change the idp.authn.flows property to "idp.authn.flows = MFA” in the idp.properties file to the DuuoAuthnConfiguration wiki article, just to save others time on this. The “General Configuration” section of that article makes Duo setup seem more simplistic than it actually is.

Also, for testing (and just so others reading this might benefit), I changed the MFA translation map in authn/mfa-authn-config.xml to the following.
——
    <util:map id="shibboleth.authn.MFA.TransitionMap">
        <entry key="">
            <bean parent="shibboleth.authn.MFA.Transition" p:nextFlow="authn/Password" />
        </entry>
        <entry key="authn/Password">
            <bean parent="shibboleth.authn.MFA.Transition" p:nextFlow="authn/Duo" />
        </entry>
    </util:map>
——
This forces Duo 2-factor auth on all login attempts (regardless of multi-factor authentication context).

— Nathan

> On Jan 17, 2017, at 1:55 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> 
>> idp.properties (typical install changes for entityID and scope plus…)
>> modified property to idp.authn.flows = Password|Duo|MFA
> 
> No, you enable MFA, that's it. You cannot enable all of them, and it's pretty much going to break if you do, or even worse. If the SP doesn't request anything special, that basically guarantees, depending on declaration order of the beans, that the Password flow alone will run and return, which is what it's doing I imagine.
> 
> -- Scott
> 
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net