Authn Context Error on Setting up Duo

[Nate Klingenstein]

Ben,

It's impossible to know what went into a frankenimplementation, but
you probably don't want to try to use Duo as a top-level flow by
itself like that.  The specific error usually means that the
AuthnContext requested isn't one that the IdP could honor, but I
suspect your first problem is that you need the password flow to chain
into the Duo flow so that the Duo flow knows whom it's supposed to be
confirming.

You'll want to use the MFA handler to integrate the flows.  The
documentation is here:

https://wiki.shibboleth.net/confluence/display/IDP30/MultiFactorAuthnConfiguration

There's a number of things you will need to do and change, though, so
I'm not sure what are the best instructions I can give you to get from
there to here.  The conceptual model changes considerably and it
sounds like you need to understand the old model, preserve the old
model, understand the new model, and render the old model in the new
model.  Just not sure where to send you for all of that.

Maybe someone has a better idea,
Nate.

On Fri, Jun 30, 2017 at 10:05 PM, Botsford, Benjamin T
<ben.botsford at austin.utexas.edu> wrote:
> Hey everyone,
>
>
>
> Apologies in advance: I’m very new to Shibboleth.
>
>
>
> My team had set up Duo with the custom plugin prior to the release of IdP
> v3.3. In order to upgrade, I had to go back and undo all of the
> customizations related to Duo. I got the upgraded deployment working for the
> Password authn flow, but I’m getting a
> “urn:oasis:names:tc:SAML:2.0:status:NoAuthnContext” error when I try to
> access a Duo-protected resource in our test environment.
>
>
>
> Here are the changes I made to configure Duo:
>
> Added our Duo config (integrationKey, secretKey, apiHost, applicationKey) to
> conf/authn/duo.properties
> Set up three beans in supportedPrincipals for the “Duo” authentication flow
> in conf/authn/general-authn.xml
>
> <bean parent=”shibboleth.SAML2AuthnContextClassRef" c:classRef="{our 2FA
> context}" />
> <bean parent=”shibboleth.SAML1AuthenticationMethod"
> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"
> />
> <bean parent=”shibboleth.SAML1AuthenticationMethod" c:classRef="{our 2FA
> context}" />
>
> Changed conf/idp.properties
>
> idp.authn.flows=Password|Duo
>
>
>
> Does anyone know if any of these changes are incorrect, or if there’s
> something that I forgot to change?
>
>
>
>
>
> Probably unhelpful additional information:
>
>
>
> The test SP was already configured to use this authentication context.
> Here’s what we’re seeing from there:
>
> <samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"
>
> AssertionConsumerServiceURL="https://example-t01.com/Shibboleth.sso/SAML2/POST"
>
> Destination="https://example-t01.com/idp/profile/SAML2/Redirect/SSO”
>
> ID="_XXXXXXXXXXXXXXXX"
>
> IssueInstant="2017-06-30T21:17:26Z"
>
> ProtocolBinding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"
> Version="2.0">
>
> <saml:Issuer
> xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://example-sp-t01.com/shibboleth</saml:Issuer>
>
> <samlp:NameIDPolicy AllowCreate="1"/>
>
> <samlp:RequestedAuthnContext>
>
> <saml:AuthnContextClassRef
> xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">{our 2FA
> context}</saml:AuthnContextClassRef>
>
> </samlp:RequestedAuthnContext>
>
> </samlp:AuthnRequest>
>
>
>
> Thanks so much for wading through that, and any thoughts you might have.
>
>
>
> -Ben
>
>
> --
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net