IDPv3.3 and programmatically selecting MFA based on attribute

[Jeffrey Eaton]

Aha, I think that fixes it, and the explanation makes sense.  Thank you so much!

-jeaton

> On Jan 22, 2017, at 9:02 PM, Scott Koranda <skoranda at gmail.com> wrote:
> 
>> Why is it just accepting the previous Password
>> authentication and not checking the attribute (and then
>> upgrading to Duo)?
>> 
> 
> This was covered in the past few days in another thread with
> the subject "MFA result reuse with Duo". You can find where it
> begins at
> 
> http://marc.info/?l=shibboleth-users&m=148476673200662&w=2
> 
> In short: 
> 
> Since the SP does not request a "MFA context" and you
> have not configured an override for that SP that requires an
> "MFA context", the IdP determines that your active authn/MFA flow
> result with the Password context satisifes the request. As
> such it does not re-run the authn/MFA flow and your strategy
> script never gets the chance to execute a second time for that
> user.
> 
> You can change that behavior by setting
> 
> idp.authn.favorSSO = false
> 
> in idp.properties and then adding
> 
> <property name="defaultAuthenticationMethods">
>  <list>
>    <ref bean="MfaPrincipal" />
>    <ref bean="PasswordPrincipal" />
>  </list>
> </property>
> 
> to either an override for that particular SP or to the DefaultRelyingParty
> in relying-party.xml, where
> 
> <bean id="MfaPrincipal" parent="shibboleth.SAML2AuthnContextClassRef" 
>  c:classRef="https://refeds.org/profile/mfa" />
> 
> <bean id="PasswordPrincipal" parent="shibboleth.SAML2AuthnContextClassRef" 
>  c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" />
> 
> (replace 'https://refeds.org/profile/mfa' with whatever you have
> configured your IdP to use as the MFA context).
> 
> The order above is important--the "MfaPrincipal" must be first.
> 
> With those changes, the IdP will run the authn/MFA flow if the user only has
> an active Password result.
> 
> Thanks,
> 
> Scott K
> -- 
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net