IdP3 Force Authentication Context for select CAS services

[Mak, David]

Resurrecting an old question that I don’t see answers for.

We’ve an old IDP 3.2.1 (to be upgraded to 3.3) that has a Unicon Duo integration.

We’ve got our banner services integrated using the native CAS implementation and would like to add Duo MFA, but our relying party setup, which looks like this:

        <bean parent="RelyingPartyByGroup" c:groupNames="banner-services">
                <property name="profileConfigurations">
                        <list>
                                <bean parent="CAS.LoginConfiguration" p:defaultAuthenticationMethods="http://www.duosecurity.com/" />
                                <bean parent="CAS.ProxyConfiguration" />
                                <bean parent="CAS.ValidateConfiguration" />
                        </list>
                </property>
        </bean>

And is matched to the CAS service registry config that looks like this:

<bean id="reloadableServiceRegistry"
          class="%{idp.cas.serviceRegistryClass:net.shibboleth.idp.cas.service.PatternServiceRegistry}">
        <property name="definitions">
            <list>
                <bean class="net.shibboleth.idp.cas.service.ServiceDefinition"
                      c:regex="https:\/\/ourbannerhost.*\.neu\.edu(:\d+)?\/.*"
                      p:group="banner-services"
                      p:authorizedToProxy="false"
                      p:singleLogoutParticipant="true" />
            </list>
        </property>
    </bean>

Fails to invoke the Duo authentication method.


From: users <users-bounces at shibboleth.net> on behalf of "O'Dowd, Josh" <Josh.O'Dowd at mso.umt.edu>
Reply-To: Shib Users <users at shibboleth.net>
Date: Wednesday, August 3, 2016 at 1:57 PM
To: Shib Users <users at shibboleth.net>
Subject: RE: IdP3 Force Authentication Context for select CAS services

> It does and that's the method that we use to selectively enable/disable
> 2FA for select services. I would recommend defining a "2fa" group
> and tag those services in your ServiceRegistry bean, then you can use
> a RelyingPartyByGroup strategy to enable it for a number of services.

I have attempted this but I am not having any luck with getting the service group recognized by the RelyingPartyByGroup strategy triggered.  Here is what I have currently:

.. conf/cas-protocol.xml:
                <bean id="cas.serviceRegistry"
          class="net.shibboleth.idp.cas.service.PatternServiceRegistry">
        <property name="definitions">
            <list>
                <!-- 2FA Services -->
                <bean class="net.shibboleth.idp.cas.service.ServiceDefinition"
                      c:regex="{some regex for service match}"
                      p:group="2FA” />
                …


.. conf/relying-party.xml:
                    <!-- Custom Profile for Duo 2FA group -->
                    <bean id="CAS.LoginConfiguration.duo" parent="CAS.LoginConfiguration">
                                <property name="defaultAuthenticationMethods">
                                                <list>
                                                                <bean parent="shibboleth.SAML2AuthnContextClassRef"
                                                                                c:classRef="http://www.duosecurity.com/" />
                                                                <bean parent="shibboleth.SAML2AuthnContextClassRef"
                                                                                c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" />
                                                </list>
                                </property>
                    </bean>

…

    <util:list id="shibboleth.RelyingPartyOverrides">
                <bean parent="RelyingPartyByGroup" c:groupNames="2FA">
                                <property name="profileConfigurations">
                                                <list>
                                                                <ref bean="CAS.LoginConfiguration.duo" />
                                                                <ref bean="CAS.ValidateConfiguration" />
                                                </list>
                                </property>
                </bean>
…

The behavior when logging in with a matching CAS service is that of the default relying party, not the “byGroup” RP; it does not seem to be group-matching on the “2FA” grouping.  I am sure I am not “tagging” the service correctly…

Any help, or an example, thanks.

Josh


From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Marvin Addison
Sent: Tuesday, August 2, 2016 6:26 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: IdP3 Force Authentication Context for select CAS services

On Mon, Aug 1, 2016 at 4:53 PM Cantor, Scott <cantor.2 at osu.edu<mailto:cantor.2 at osu.edu>> wrote:
The IdP can default in the form of authentication to use based on a RelyingParty override, see the defaultAuthenticationMethods property on any of the SSO profile configurations. The CAS login config should have that property.

It does and that's the method that we use to selectively enable/disable 2FA for select services. I would recommend defining a "2fa" group and tag those services in your ServiceRegistry bean, then you can use a RelyingPartyByGroup strategy to enable it for a number of services.

M

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170720/89ffb2fb/attachment-0001.html>