Forcing Duo 2FA at the IdP

[Hall, Gerry]

I have a use case where I have to ensure that the SP always uses Duo 2FA.   I am trying to do this by forcing the IdP to always use Duo 2FA when authenticating the SP.   I am doing this by adding an entry in the relying-party.xml (see below for entries and tests).  However, this only works if I have an existing session.  Here is the error that I am getting in the idp-process.log:

 127.0.0.1|2017-01-18 14:50:20,242|208F8C77B365683C46CAA43C337A474D| - ERROR [net.shibboleth.idp.authn:-2] -
                Uncaught runtime exception java.lang.NullPointerException: null at com.duosecurity.duoweb.DuoWeb.signRequest(DuoWeb.java:29)
                127.0.0.1|2017-01-18 14:50:20,250|208F8C77B365683C46CAA43C337A474D| - WARN [org.opensaml.profile.action.impl.LogEvent:105] -
                A non-proceed event occurred while processing the request: RuntimeException

Note that I am testing using a clean install of IdP v3.3.0.  Also, having other SP's explicitly request the Duo authnContext https://login.emory.edu/duo  also works (i.e., no entry in the relying-party.xml)

What am I doing wrong?

As examples, tests 1 and 2 are what I would expect; tests 3 and 4 are where I am having problems.
Per the docs at https://wiki.shibboleth.net/confluence/display/IDP30/Configuring+the+IdP+for+the+Multi-Context+Broker+Model , here is the configuration that I am using in the relying-party.xml to force Duo 2FA for the two SP's:
    1.
    <bean id="SAML2.SSO.requireDuo" parent="SAML2.SSO">
       <property name="defaultAuthenticationMethods">
           <list>
               <bean parent="shibboleth.SAML2AuthnContextClassRef"
                   c:classRef="https://login.emory.edu/duo" />
           </list>
       </property>
    </bean>

    2.
    <bean parent="RelyingPartyByName"
                    c:relyingPartyIds="#{{'doeLEGAL_sp'}}">
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO.requireDuo"
                            p:encryptAssertions="false"
                            p:encryptNameIDs="false"
                            p:includeAttributeStatement="true"
                            p:signAssertions="false"
                            p:signResponses="false"

                        />
                </list>
            </property>
    </bean>

    <bean parent="RelyingPartyByName"
                    c:relyingPartyIds="#{{'https://gerry.emory.edu'}}">
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO.requireDuo"
                        />
                </list>
            </property>
        </bean>


Following are my tests cases with results.
    1.  Clear browser cache and close browsr.
        First login to another app that requites normal Shibboleth auth.
Then login to the app doeLEGAL_sp service.
            Results:
                get the DUO prompt,
access to the app is granted.

    2.  Clear browser cache and close browsr.
        Login to another app that requires DUO 2FA.
Then login to the app doeLEGAL_sp service.
             Results:
                access to the app is granted (i.e., no additional DUO prompt).

    3.  Clear browser cache and close browser.
 Then login to the app doeLEGAL_sp service.
            Results:
                Get the following error in the idp-process.log:

                127.0.0.1|2017-01-18 14:50:20,242|208F8C77B365683C46CAA43C337A474D| - ERROR [net.shibboleth.idp.authn:-2] -
                Uncaught runtime exception java.lang.NullPointerException: null at com.duosecurity.duoweb.DuoWeb.signRequest(DuoWeb.java:29)
                127.0.0.1|2017-01-18 14:50:20,250|208F8C77B365683C46CAA43C337A474D| - WARN [org.opensaml.profile.action.impl.LogEvent:105] -
                A non-proceed event occurred while processing the request: RuntimeException

    4.  Since the SP doeLEGA_sp is a vendor app, I wanted to ensure that this is not vendor related.
  Get the same results and error as in #3.








________________________________

This e-mail message (including any attachments) is for the sole use of
the intended recipient(s) and may contain confidential and privileged
information. If the reader of this message is not the intended
recipient, you are hereby notified that any dissemination, distribution
or copying of this message (including any attachments) is strictly
prohibited.

If you have received this message in error, please contact
the sender by reply e-mail message and destroy all copies of the
original message (including attachments).
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170118/3b267c65/attachment.html>