IdP3 Force Authentication Context for select CAS services

[Marvin Addison]

On Thu, Jul 20, 2017 at 3:09 PM Mak, David <d.mak at northeastern.edu> wrote:

> We’ve got our banner services integrated using the native CAS
> implementation and would like to add Duo MFA
>

You can absolutely do this. We rely on the ability to switch authentication
methods based on CAS protocol details and it works as you seem to expect.


> our relying party setup, which looks like this:
>

>
>         <bean parent="RelyingPartyByGroup" c:groupNames="banner-services">
>
>                 <property name="profileConfigurations">
>
>                         <list>
>
>                                 <bean parent="CAS.LoginConfiguration"
> p:defaultAuthenticationMethods="http://www.duosecurity.com/" />
>

I have no experience with the Unicon plugins, but the general approach of
customizing profile configurations here based on a group name is the key
feature, and it works like you expect.


> And is matched to the CAS service registry config that looks like this:
>
>                 <bean
> class="net.shibboleth.idp.cas.service.ServiceDefinition"
>
>
> c:regex="https:\/\/ourbannerhost.*\.neu\.edu(:\d+)?\/.*"
>

The regular expression looks suspect. First, you don't have to escape
forward slashes and, second, wildcarding is dangerous. If you're trying to
say "any subdomain containing this host in our domain", then here's how you
could safely say that:

https://ourbannerhost(\.[A-Za-z_-]+)*\.neu\.edu(:\d+)?\/.*
<https://ourbannerhost(.[A-Za-z_-]+)*\.neu\.edu(:\d+)?\/.*>

M
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170724/7bda7e2f/attachment.html>