Error in MFA with disallowed AUTHNCONTEXT + requested PasswordProtectedTransport

[Leite, Zailo S.]

I have a SP that requires PasswordProtectedTransport. If we set
disallowedFeatures-ref="SAML2.SSO.FEATURE_AUTHNCONTEXT" in
relying-party.xml, per the wiki, we get an error:

2017-06-30 14:26:52,953 [131.215.234.29]
[8D9F6B6CA73848056306C9FBC721495D] WARN
[net.shibboleth.idp.saml.saml2.profile.impl.ProcessRequestedAuthnContext:184] Profile Action ProcessRequestedAuthnContext: Incoming RequestedAuthnContext disallowed by profile configuration
2017-06-30 14:26:53,004 [131.215.234.29]
[8D9F6B6CA73848056306C9FBC721495D] WARN
[org.opensaml.profile.action.impl.LogEvent:105] A non-proceed event
occurred while processing the request: InvalidAuthenticationContext

Any help would be greatly appreciated.

The test SP is configured with:
ShibRequestSetting authnContextClassRef
"urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"

Z

Zailo Leite, Caltech

relying-party.xml :
---------------------
      <bean id="SAML2.SSO.requireDuo" parent="RelyingPartyByName"
           c:relyingPartyIds="#{{
           'https://sp0-test.caltech.edu/shibboleth' }}">
           <property name="profileConfigurations">
              <list>
                 <bean parent="SAML2.SSO"
p:disallowedFeatures-ref="SAML2.SSO.FEATURE_AUTHNCONTEXT">
                    <property name="defaultAuthenticationMethods">
                       <list>
                         <bean id="MfaPrincipal"
parent="shibboleth.SAML2AuthnContextClassRef"

c:classRef="http://id.incommon.org/assurance/mfa" />
                         <bean id="PasswordPrincipal"
parent="shibboleth.SAML2AuthnContextClassRef"

c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" />
                       </list>
                    </property>
                 </bean>
              </list>
           </property>
       </bean>

    </util:list>
---------------------

mfa-authn-config.xml :
---------------------
<bean id="checkSecondFactor"
parent="shibboleth.ContextFunctions.Scripted"
factory-method="inlineScript"
        p:customObject-ref="shibboleth.AttributeResolverService">
    <constructor-arg>
        <value>
        <![CDATA[
            logger =
Java.type("org.slf4j.LoggerFactory").getLogger("net.shibboleth.idp.attribute");
            nextFlow = null;

            // Go straight to second factor if we have to, or set up for
an attribute lookup first.
            authCtx =
input.getSubcontext("net.shibboleth.idp.authn.context.AuthenticationContext");
            mfaCtx =
authCtx.getSubcontext("net.shibboleth.idp.authn.context.MultiFactorAuthenticationContext");
            if (mfaCtx.isAcceptable()) {
                // Attribute check is required to decide if first factor
alone is enough.
                resCtx = input.getSubcontext(

"net.shibboleth.idp.attribute.resolver.context.AttributeResolutionContext", true);

                // Look up the username
                usernameLookupStrategyClass =
Java.type("net.shibboleth.idp.session.context.navigate.CanonicalUsernameLookupStrategy");
                usernameLookupStrategy = new
usernameLookupStrategyClass();

resCtx.setPrincipal(usernameLookupStrategy.apply(input));

                // resolve the attribute to determine if a first factor
is sufficient

resCtx.getRequestedIdPAttributeNames().add("eduPersonEntitlement");
                resCtx.resolveAttributes(custom);

                // Check for an attribute value that requires second
factor.
                attribute =
resCtx.getResolvedIdPAttributes().get("eduPersonEntitlement");
                logger.info("MFA_AUTHN: ResolvedIdPAttributes are " +
attribute.getValues());
                logger.info("MFA_AUTHN: nextFlow is " + nextFlow);
                valueType =
Java.type("net.shibboleth.idp.attribute.StringAttributeValue");
                if (attribute.getValues().contains(new
valueType("bogus"))) {
                     nextFlow = "authn/Duo";
                }
                logger.info("MFA_AUTHN: nextFlow is " + nextFlow);

                input.removeSubcontext(resCtx);   // cleanup
            }

            nextFlow;   // pass control to second factor or end with the
first
        ]]>
    </value>
    </constructor-arg>
</bean>
---------------------