IDPv3.3 and programmatically selecting MFA based on attribute

[Scott Koranda]

> Why is it just accepting the previous Password
> authentication and not checking the attribute (and then
> upgrading to Duo)?
> 

This was covered in the past few days in another thread with
the subject "MFA result reuse with Duo". You can find where it
begins at

http://marc.info/?l=shibboleth-users&m=148476673200662&w=2

In short: 

Since the SP does not request a "MFA context" and you
have not configured an override for that SP that requires an
"MFA context", the IdP determines that your active authn/MFA flow
result with the Password context satisifes the request. As
such it does not re-run the authn/MFA flow and your strategy
script never gets the chance to execute a second time for that
user.

You can change that behavior by setting

idp.authn.favorSSO = false

in idp.properties and then adding

<property name="defaultAuthenticationMethods">
  <list>
    <ref bean="MfaPrincipal" />
    <ref bean="PasswordPrincipal" />
  </list>
</property>

to either an override for that particular SP or to the DefaultRelyingParty
in relying-party.xml, where

<bean id="MfaPrincipal" parent="shibboleth.SAML2AuthnContextClassRef" 
  c:classRef="https://refeds.org/profile/mfa" />

<bean id="PasswordPrincipal" parent="shibboleth.SAML2AuthnContextClassRef" 
  c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" />

(replace 'https://refeds.org/profile/mfa' with whatever you have
configured your IdP to use as the MFA context).

The order above is important--the "MfaPrincipal" must be first.

With those changes, the IdP will run the authn/MFA flow if the user only has
an active Password result.

Thanks,

Scott K