Error in MFA with disallowed AUTHNCONTEXT + requested PasswordProtectedTransport

[Leite, Zailo S.]

Actually I backported the patch IDP-1114 to 3.3.1 .
I added "idp.authn.flows.MFA.dontreuse = true" to idp.properties , and

<property name="reuseCondition">
   <bean parent="shibboleth.Conditions.NOT">
       <constructor-arg
value="%{idp.authn.flows.MFA.dontreuse:false}" />
   </bean>
</property>

to the authn/MFA bean.

Works like a charm! Thank you!

Z

On Mon, 2017-07-10 at 20:34 +0000, Cantor, Scott wrote:
> > Thanks for the confirmation. I fully agree that the blame is on the SPs.
> 
> Possible hack if you're manually configuring the SP's settings to begin with: tell it to send its SAML requests to a bogus endpoint you control, and stick a CGI script there that just pokes the IdP to do an IdP-initiated SSO back to it.
> 
> -- Scott
>