IdP3 Force Authentication Context for select CAS services

[Mak, David]

Thank you Scott, for the quick reply. I went ahead and modified the Unicon configuration file META-INF/shibboleth-idp/conf/global.xml to be as follows, replacing http://www.duosecurity.com/ with urn:duosecurity:

    <bean id="authn/Duo" parent="shibboleth.AuthenticationFlow"
          p:nonBrowserSupported="false" p:forcedAuthenticationSupported="%{duo.forcedAuthenticationSupported:true}">
        <property name="supportedPrincipals">
            <util:list>
                <bean parent="shibboleth.SAML2AuthnContextClassRef"
                      c:classRef="urn:duosecurity" />
                                <bean parent="shibboleth.SAML2AuthnContextClassRef"
                      c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" />
                <bean parent="shibboleth.SAML1AuthenticationMethod"
                      c:method="urn:duosecurity" />
            </util:list>
        </property>
    </bean>

I have two relying party configurations for SP’s:

This SAML2 SP works, and invokes the Duo MFA iframe:
        <bean parent="RelyingPartyByName"
                c:relyingPartyIds="#{{'https://neuidmdev.neu.edu'}}">
                <property name="profileConfigurations">
                        <list>
                                <bean parent="SAML2.SSO" p:encryptAssertions="false" p:encryptNameIDs="false" p:signAssertions="conditional" p:defaultAuthenticationMethods="urn:duosecurity" />
                        </list>
                </property>
        </bean>

And results in the following log entry after a successful Duo MFA verification:
2017-07-21 11:35:17,398 - INFO [net.unicon.iam.shibboleth.idp.authn.duo.authn.ValidateDuoResponse:-2] - Profile Action ValidateDuoResponse: Duo Login succeeded

This CAS SP still doesn’t:
        <bean parent="RelyingPartyByGroup" c:groupNames="banner-services">
                <property name="profileConfigurations">
                        <list>
                                <bean parent="CAS.LoginConfiguration" p:defaultAuthenticationMethods="urn:duosecurity" />
                                <bean parent="CAS.ValidateConfiguration" />
                        </list>
                </property>
        </bean>

If I remove the CAS.ValidateConfiguration bean from the profile configurations list, I can force a failed assertion with this in our log:
2017-07-21 11:56:15,764 - WARN [net.shibboleth.idp.profile.impl.SelectProfileConfiguration:111] - Profile Action SelectProfileConfiguration: Profile https://www.apereo.org/cas/protocol/serviceValidate is not available for relying party configuration EntityGroups[banner-services,]
2017-07-21 11:56:15,785 - WARN [org.opensaml.profile.action.impl.LogEvent:76] - An error event occurred while processing the request: InvalidProfileConfiguration

So, it shows the relying party group is being resolved properly. I just don’t seem to get any action on the defaultAuthenticationMethods parameter.

Any suggestions to how I can debug this further would be appreciated.

On 7/20/17, 3:23 PM, "users on behalf of Cantor, Scott" <users-bounces at shibboleth.net on behalf of cantor.2 at osu.edu> wrote:

    >                                 <bean parent="CAS.LoginConfiguration"
    > p:defaultAuthenticationMethods="http://www.duosecurity.com/" />
    
    People have indicated that using strings like that works, but to my understanding it really shouldn't, the property type there is a collection of AuthnContextClassRefPrincipal objects and certainly all our examples and documentation assume that. At minimum, it may be that it works in some cases and not others, so depending on it working on simple strings like that seems unwise.
    
    -- Scott
    
    
    -- 
    To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net