IDPv3.3 and programmatically selecting MFA based on attribute

Thu Mar 23 10:11:50 EDT 2017

When I login to a non-Duo SP, then login to a Duo SP, I get prompted again for login instead of just the secondFactor.  Here's what I'm seeing in the logs.

2017-03-23 10:08:08,277 - DEBUG [net.shibboleth.idp.authn.impl.PopulateAuthenticationContext:200] - Profile Action PopulateAuthenticationContext: Installed 1 potential authentication flows into AuthenticationContext|130.64.204.128
2017-03-23 10:08:08,523 - INFO [edu.internet2.middleware.shibboleth.resolver.Script.eduPersonAssurance:16] - Getting eduPersonAssurance for: https://ess-test-01.uit.tufts.edu/dummy_site -> pho01|130.64.204.128
.
.
.
2017-03-23 10:08:08,530 - INFO [edu.internet2.middleware.shibboleth.resolver.Script.eduPersonAssurance:63] - setting eduPersonAssurance attribute value to urn:tufts.edu:ac:classes:PasswordProtectedTransport:duo|130.64.204.128
2017-03-23 10:08:08,537 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByAttribute:152] - Profile Action FilterFlowsByAttribute: Filtering inactive flows available for use|130.64.204.128
2017-03-23 10:08:08,538 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByAttribute:212] - Profile Action FilterFlowsByAttribute: Looking for match for flow authn/MFA against values for attribute eduPersonAssurance|130.64.204.128
2017-03-23 10:08:08,539 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByAttribute:215] - Profile Action FilterFlowsByAttribute: Comparing principal urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocol against attribute values [StringAttributeValue{value=urn:tufts.edu:ac:classes:PasswordProtectedTransport:duo}]|130.64.204.128
2017-03-23 10:08:08,539 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByAttribute:215] - Profile Action FilterFlowsByAttribute: Comparing principal urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport against attribute values [StringAttributeValue{value=urn:tufts.edu:ac:classes:PasswordProtectedTransport:duo}]|130.64.204.128
2017-03-23 10:08:08,540 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByAttribute:215] - Profile Action FilterFlowsByAttribute: Comparing principal urn:oasis:names:tc:SAML:2.0:ac:classes:Password against attribute values [StringAttributeValue{value=urn:tufts.edu:ac:classes:PasswordProtectedTransport:duo}]|130.64.204.128
2017-03-23 10:08:08,540 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByAttribute:215] - Profile Action FilterFlowsByAttribute: Comparing principal urn:oasis:names:tc:SAML:1.0:am:password against attribute values [StringAttributeValue{value=urn:tufts.edu:ac:classes:PasswordProtectedTransport:duo}]|130.64.204.128
2017-03-23 10:08:08,541 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByAttribute:215] - Profile Action FilterFlowsByAttribute: Comparing principal urn:tufts.edu:ac:classes:PasswordProtectedTransport:duo against attribute values [StringAttributeValue{value=urn:tufts.edu:ac:classes:PasswordProtectedTransport:duo}]|130.64.204.128
2017-03-23 10:08:08,541 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByAttribute:161] - Profile Action FilterFlowsByAttribute: Retaining flow authn/MFA, matched custom Principal urn:tufts.edu:ac:classes:PasswordProtectedTransport:duo|130.64.204.128
2017-03-23 10:08:08,542 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByAttribute:173] - Profile Action FilterFlowsByAttribute: Potential authentication flows left after filtering: {authn/MFA=AuthenticationFlowDescriptor{flowId=authn/MFA, supportsPassive=true, supportsForcedAuthentication=true, lifetime=3600000, inactivityTimeout=1800000}}|130.64.204.128
2017-03-23 10:08:08,542 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByAttribute:177] - Profile Action FilterFlowsByAttribute: Filtering active results available for reuse|130.64.204.128
2017-03-23 10:08:08,543 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByAttribute:236] - Profile Action FilterFlowsByAttribute: Looking for match for active result of flow authn/MFA against values for attribute eduPersonAssurance|130.64.204.128
2017-03-23 10:08:08,543 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByAttribute:239] - Profile Action FilterFlowsByAttribute: Comparing principal pho01 against attribute values [StringAttributeValue{value=urn:tufts.edu:ac:classes:PasswordProtectedTransport:duo}]|130.64.204.128
2017-03-23 10:08:08,544 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByAttribute:239] - Profile Action FilterFlowsByAttribute: Comparing principal authn/Password against attribute values [StringAttributeValue{value=urn:tufts.edu:ac:classes:PasswordProtectedTransport:duo}]|130.64.204.128
2017-03-23 10:08:08,544 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByAttribute:239] - Profile Action FilterFlowsByAttribute: Comparing principal pho01 against attribute values [StringAttributeValue{value=urn:tufts.edu:ac:classes:PasswordProtectedTransport:duo}]|130.64.204.128
2017-03-23 10:08:08,546 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByAttribute:239] - Profile Action FilterFlowsByAttribute: Comparing principal urn:oasis:names:tc:SAML:2.0:ac:classes:Password against attribute values [StringAttributeValue{value=urn:tufts.edu:ac:classes:PasswordProtectedTransport:duo}]|130.64.204.128
2017-03-23 10:08:08,546 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByAttribute:239] - Profile Action FilterFlowsByAttribute: Comparing principal urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport against attribute values [StringAttributeValue{value=urn:tufts.edu:ac:classes:PasswordProtectedTransport:duo}]|130.64.204.128
2017-03-23 10:08:08,547 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByAttribute:239] - Profile Action FilterFlowsByAttribute: Comparing principal urn:oasis:names:tc:SAML:1.0:am:password against attribute values [StringAttributeValue{value=urn:tufts.edu:ac:classes:PasswordProtectedTransport:duo}]|130.64.204.128
2017-03-23 10:08:08,547 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByAttribute:189] - Profile Action FilterFlowsByAttribute: Removing active result from flow authn/MFA, Principals did not match any attribute values|130.64.204.128
2017-03-23 10:08:08,548 - INFO [net.shibboleth.idp.authn.impl.FilterFlowsByAttribute:196] - Profile Action FilterFlowsByAttribute: No active authentication results remain after filtering|130.64.204.128
2017-03-23 10:08:08,554 - DEBUG [net.shibboleth.idp.authn.impl.InitializeRequestedPrincipalContext:152] - Profile Action InitializeRequestedPrincipalContext: Profile configuration did not supply any default authentication methods|130.64.204.128
2017-03-23 10:08:08,554 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByForcedAuthn:53] - Profile Action FilterFlowsByForcedAuthn: Request does not have forced authentication requirement, nothing to do|130.64.204.128
2017-03-23 10:08:08,555 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByNonBrowserSupport:53] - Profile Action FilterFlowsByNonBrowserSupport: Request does not have non-browser requirement, nothing to do|130.64.204.128
2017-03-23 10:08:08,561 - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:255] - Profile Action SelectAuthenticationFlow: No specific Principals requested|130.64.204.128
2017-03-23 10:08:08,561 - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:290] - Profile Action SelectAuthenticationFlow: No usable active results available, selecting an inactive flow|130.64.204.128
2017-03-23 10:08:08,562 - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:338] - Profile Action SelectAuthenticationFlow: Selecting inactive authentication flow authn/MFA|130.64.204.128
2017-03-23 10:08:08,568 - DEBUG [net.shibboleth.idp.authn.impl.PopulateMultiFactorAuthenticationContext:164] - Profile Action PopulateMultiFactorAuthenticationContext: 0 active result(s) extracted for possible reuse|130.64.204.128
2017-03-23 10:08:08,574 - DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:195] - Profile Action TransitionMultiFactorAuthentication: Applying MFA transition rule to determine initial state|130.64.204.128
2017-03-23 10:08:08,575 - DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:214] - Profile Action TransitionMultiFactorAuthentication: MFA flow transition after 'proceed' event to 'authn/Password' flow|130.64.204.128
2017-03-23 10:08:08,583 - DEBUG [net.shibboleth.idp.authn.impl.ExtractUsernamePasswordFromBasicAuth:115] - Profile Action ExtractUsernamePasswordFromBasicAuth: No appropriate Authorization header found|130.64.204.128

Thanks,
-PQ

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Wednesday, March 22, 2017 1:53 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: IDPv3.3 and programmatically selecting MFA based on attribute

On 3/22/17, 1:43 PM, "users on behalf of Ho, PeiQuan" <users-bounces at shibboleth.net on behalf of PeiQuan.Ho at tufts.edu> wrote:

> I updated the MFA script to something like below.  But now the SSO is not functioning as expected.

Then you'll need to dig more into how it all works to debug it, and probably get more logging out. There's some fairly detailed logging of the Transition action when it decides what to do.

> When I log into a site requiring Duo, then SSO to a site that does 
> not, the SSO works. But when I first login to a site that does not require Duo, then SSO to one that does, the IDP requires a re-login instead of just running the second factor (Duo).

If you tell the MFA flow to run authn/Password it will bypass that if it already has a result on hand from it that it can reuse. That's all I can really tell you. In most cases, the reuse of a result should be fairly automatic so you don't have to get fancy in the scripts deciding whether to run a flow or not, you can just run it and let it figure out what to do.

> duoValue = "urn:tufts.edu:ac:classes:PasswordProtectedTransport:duo"

That value is, FWIW, not valid. You can't make up URNs like that.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net