IDPv3.3 and programmatically selecting MFA based on attribute

Thu Mar 23 14:31:03 EDT 2017

I actually was not able to upgrade our v3.2.0 instance to v3.3 due to conflicts with the previous unicon/duo setup.  Instead I had to start fresh and transfer over what we needed in order to match our current setup.  The authn setup therefore is working from a fresh install.  In any case, currently it's setup with these settings for idp.properties

idp.authn.flows = MFA
#idp.authn.flows.initial = Password
#idp.authn.resolveAttribute = eduPersonAssurance

One thing I noticed is the first login to an SP, the MFA runs the first factor (Password), then check the second factor (Duo) as shown in Log 1 below.  But then, when I SSO to another SP, it seems like the MFA flows are not actually run at all, but just checks what's in the cache.  This is shown in Log 2 below.  Also, turning off the idp.authn.resolveAttribute setting, the SP gives me an error: " The gap between now and the time you logged into your identity provider exceeds the limit."

==LOG 1==
2017-03-23 14:21:54,942 - DEBUG [net.shibboleth.idp.authn.impl.PopulateAuthenticationContext:200] - Profile Action PopulateAuthenticationContext: Installed 1 potential authentication flows into AuthenticationContext|130.64.204.128
2017-03-23 14:21:54,948 - DEBUG [net.shibboleth.idp.authn.impl.InitializeRequestedPrincipalContext:152] - Profile Action InitializeRequestedPrincipalContext: Profile configuration did not supply any default authentication methods|130.64.204.128
2017-03-23 14:21:54,949 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByForcedAuthn:53] - Profile Action FilterFlowsByForcedAuthn: Request does not have forced authentication requirement, nothing to do|130.64.204.128
2017-03-23 14:21:54,953 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByNonBrowserSupport:53] - Profile Action FilterFlowsByNonBrowserSupport: Request does not have non-browser requirement, nothing to do|130.64.204.128
2017-03-23 14:21:54,954 - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:255] - Profile Action SelectAuthenticationFlow: No specific Principals requested|130.64.204.128
2017-03-23 14:21:54,955 - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:290] - Profile Action SelectAuthenticationFlow: No usable active results available, selecting an inactive flow|130.64.204.128
2017-03-23 14:21:54,956 - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:338] - Profile Action SelectAuthenticationFlow: Selecting inactive authentication flow authn/MFA|130.64.204.128
2017-03-23 14:21:54,964 - DEBUG [net.shibboleth.idp.authn.impl.PopulateMultiFactorAuthenticationContext:164] - Profile Action PopulateMultiFactorAuthenticationContext: 0 active result(s) extracted for possible reuse|130.64.204.128
2017-03-23 14:21:54,976 - DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:195] - Profile Action TransitionMultiFactorAuthentication: Applying MFA transition rule to determine initial state|130.64.204.128
2017-03-23 14:21:54,982 - DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:214] - Profile Action TransitionMultiFactorAuthentication: MFA flow transition after 'proceed' event to 'authn/Password' flow|130.64.204.128
2017-03-23 14:21:54,990 - DEBUG [net.shibboleth.idp.authn.impl.ExtractUsernamePasswordFromBasicAuth:115] - Profile Action ExtractUsernamePasswordFromBasicAuth: No appropriate Authorization header found|130.64.204.128
2017-03-23 14:21:56,463 - DEBUG [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:142] - Profile Action ValidateUsernamePasswordAgainstLDAP: Attempting to authenticate user pho01|130.64.204.128
2017-03-23 14:21:56,571 - INFO [org.ldaptive.auth.Authenticator:282] - Authentication succeeded for dn: tuftsedutrunk=98A0687E36A82521382049B7861A3246, ou=People, dc=tufts, dc=edu|130.64.204.128
2017-03-23 14:21:56,572 - INFO [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:152] - Profile Action ValidateUsernamePasswordAgainstLDAP: Login by 'pho01' succeeded|130.64.204.128
2017-03-23 14:21:56,580 - DEBUG [net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext:79] - Profile Action PopulateSubjectCanonicalizationContext: Installing 2 canonicalization flows into SubjectCanonicalizationContext|130.64.204.128
2017-03-23 14:21:56,582 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] - Profile Action SelectSubjectCanonicalizationFlow: Checking canonicalization flow c14n/x500 for applicability...|130.64.204.128
2017-03-23 14:21:56,583 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:106] - Profile Action SelectSubjectCanonicalizationFlow: Canonicalization flow c14n/x500 was not applicable to this request|130.64.204.128
2017-03-23 14:21:56,583 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] - Profile Action SelectSubjectCanonicalizationFlow: Checking canonicalization flow c14n/simple for applicability...|130.64.204.128
2017-03-23 14:21:56,583 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:83] - Profile Action SelectSubjectCanonicalizationFlow: Selecting canonicalization flow c14n/simple|130.64.204.128
2017-03-23 14:21:56,591 - DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:184] - Profile Action TransitionMultiFactorAuthentication: Preserving authentication result from 'authn/Password' flow|130.64.204.128
2017-03-23 14:21:56,591 - DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:197] - Profile Action TransitionMultiFactorAuthentication: Applying MFA transition rule to exit state 'authn/Password'|130.64.204.128
2017-03-23 14:21:56,599 - INFO [edu.internet2.middleware.shibboleth.resolver.Script.eduPersonAssurance:9] - Checking eduPersonAssurance|130.64.204.128
2017-03-23 14:21:56,837 - INFO [edu.internet2.middleware.shibboleth.resolver.Script.eduPersonAssurance:63] - setting eduPersonAssurance attribute value to urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport|130.64.204.128
2017-03-23 14:21:56,839 - INFO [edu.internet2.middleware.shibboleth.resolver.Script.eduPersonAssurance:32] - User DOES NOT requires DUO|130.64.204.128
2017-03-23 14:21:56,840 - DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:219] - Profile Action TransitionMultiFactorAuthentication: MFA flow completing with event 'proceed'|130.64.204.128
2017-03-23 14:21:56,847 - DEBUG [net.shibboleth.idp.authn.impl.FinalizeMultiFactorAuthentication:193] - Profile Action FinalizeMultiFactorAuthentication: MFA complete, producing merged result|130.64.204.128
2017-03-23 14:21:56,848 - DEBUG [net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext:79] - Profile Action PopulateSubjectCanonicalizationContext: Installing 2 canonicalization flows into SubjectCanonicalizationContext|130.64.204.128
2017-03-23 14:21:56,848 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] - Profile Action SelectSubjectCanonicalizationFlow: Checking canonicalization flow c14n/x500 for applicability...|130.64.204.128
2017-03-23 14:21:56,849 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:106] - Profile Action SelectSubjectCanonicalizationFlow: Canonicalization flow c14n/x500 was not applicable to this request|130.64.204.128
2017-03-23 14:21:56,849 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] - Profile Action SelectSubjectCanonicalizationFlow: Checking canonicalization flow c14n/simple for applicability...|130.64.204.128
2017-03-23 14:21:56,850 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:83] - Profile Action SelectSubjectCanonicalizationFlow: Selecting canonicalization flow c14n/simple|130.64.204.128
2017-03-23 14:21:56,857 - DEBUG [net.shibboleth.idp.authn.impl.FinalizeAuthentication:137] - Profile Action FinalizeAuthentication: Canonical principal name was established as 'pho01'|130.64.204.128
2017-03-23 14:21:56,858 - DEBUG [net.shibboleth.idp.authn.impl.FinalizeAuthentication:186] - Profile Action FinalizeAuthentication: Request did not have explicit authentication requirements, result is accepted|130.64.204.128

==LOG 2==
2017-03-23 14:24:26,774 - DEBUG [net.shibboleth.idp.authn.impl.PopulateAuthenticationContext:200] - Profile Action PopulateAuthenticationContext: Installed 1 potential authentication flows into AuthenticationContext|130.64.204.128
2017-03-23 14:24:26,781 - DEBUG [net.shibboleth.idp.authn.impl.InitializeRequestedPrincipalContext:152] - Profile Action InitializeRequestedPrincipalContext: Profile configuration did not supply any default authentication methods|130.64.204.128
2017-03-23 14:24:26,785 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByForcedAuthn:53] - Profile Action FilterFlowsByForcedAuthn: Request does not have forced authentication requirement, nothing to do|130.64.204.128
2017-03-23 14:24:26,786 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByNonBrowserSupport:53] - Profile Action FilterFlowsByNonBrowserSupport: Request does not have non-browser requirement, nothing to do|130.64.204.128
2017-03-23 14:24:26,787 - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:255] - Profile Action SelectAuthenticationFlow: No specific Principals requested|130.64.204.128
2017-03-23 14:24:26,788 - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:354] - Profile Action SelectAuthenticationFlow: Reusing active result authn/MFA|130.64.204.128
2017-03-23 14:24:26,789 - DEBUG [net.shibboleth.idp.authn.impl.FinalizeAuthentication:144] - Profile Action FinalizeAuthentication: Canonical principal name established from session as 'pho01'|130.64.204.128
2017-03-23 14:24:26,790 - DEBUG [net.shibboleth.idp.authn.impl.FinalizeAuthentication:186] - Profile Action FinalizeAuthentication: Request did not have explicit authentication requirements, result is accepted|130.64.204.128

Thanks,
-PQ

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Thursday, March 23, 2017 1:26 PM
To: Shib Users <users at shibboleth.net>
Subject: RE: IDPv3.3 and programmatically selecting MFA based on attribute

> I thought that's what I was trying to do.

The old feature you're using is not for use with the MFA feature, it's an old, broken way of trying to do a tiny subset of the things the MFA feature is designed to do, and it can't be sensibly mixed with it.

If you're also using the initial-authn feature, which tends to go hand in hand with that attribute property, then you MUST get rid of that. That will also destroy any chance of getting this to work right. You didn't say you were using it, and I didn't ask, but you really can't use one without the other most of the time.

 > * I set idp.authn.flows = MFA

The way the filtering "feature/bug" works is by filtering which flows are available for use or reuse. If you only have a single login flow enabled to begin with, then it can break the whole system by filtering out the MFA flow and rendering it unusable. At which point the IdP will give up and say there are no flows it can try and fail the login. The feature simply has no role anymore.

> * In authn/mfa-authn-config.xml, I want to decide whether to do Duo 
> based on attribute eduPersonAssurance.  That attribute is merely a 
> string.  If the value is " 
> urn:tufts.edu:ac:classes:PasswordProtectedTransport:duo", I set the nextFlow as "authn/Duo".

You're enabling the property because you want the IdP to resolve the attribute, but that property doesn't just do that one thing, it also applies a filtering step that will break. You have to turn it off and resolve the attribute from within the MFA flow itself.

Also, you often can't really use that property at all unless you also have the initial-authn feature in use and that is hopeless.

You have to understand that everything you did with the authentication layer other than the login form and the specific settings related to how the password is handled are defunct. Everything else you configured and used has to be undone.

> This seems to be working except when the SSO scenario I had mentioned.

It cannot be working, so I don't know what to tell you, I just know from the log that there's something deeply wrong with it.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net