IDP 3.3.1 MFA issue

[Hong Ye]

Hello,

I’m having exactly the same issue described in this thread:
(If I go to first the non-Duo requiring SP, I am prompted for password then sent to the SP.  If I then go to the optionally Duo-requiring SP, it never seems to perform the MFA flow to check for second factor. )
http://shibboleth.1660669.n2.nabble.com/IDPv3-3-and-programmatically-selecting-MFA-based-on-attribute-td7630903.html


I tried the solution posted by Scott Koranda in that thread. It still doesn’t work for me. Our primary authentication is authn/RemoteUser. I’m sure I’m missing something in my configuration, but I can't’ figured it out.

In idp.properties:
idp.authn.flows= MFA
idp.authn.favorSSO = false


I added following to DefaultRelyingParty:
<bean parent="SAML2.SSO">
     <property name="defaultAuthenticationMethods">
           <list>
                <bean parent="shibboleth.SAML2AuthnContextClassRef"
                      c:classRef="http://cornell.edu/mfa" />
                        <bean parent="shibboleth.SAML2AuthnContextClassRef"
                           c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" />
           </list>
      </property>
</bean>

general-authn.xml
<bean id="authn/Duo" parent="shibboleth.AuthenticationFlow"
                p:forcedAuthenticationSupported="true"
                p:nonBrowserSupported="false">

            <property name="supportedPrincipals">
                <list>
                     <bean parent="shibboleth.SAML2AuthnContextClassRef"
                         c:classRef="http://cornell.edu/mfa" />
                     <bean parent="shibboleth.SAML1AuthenticationMethod"
                         c:method="http://cornell.edu/mfa" />
                </list>
            </property>
</bean>

<bean id="authn/MFA" parent="shibboleth.AuthenticationFlow"
                p:passiveAuthenticationSupported="true"
                p:forcedAuthenticationSupported="true">

            <property name="supportedPrincipals">
                <list>

                    <bean parent="shibboleth.SAML2AuthnContextClassRef"
                        c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocol" />
                    <bean parent="shibboleth.SAML2AuthnContextClassRef"
                        c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" />
                    <bean parent="shibboleth.SAML2AuthnContextClassRef"
                        c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:Password" />
                    <bean parent="shibboleth.SAML1AuthenticationMethod"
                        c:method="urn:oasis:names:tc:SAML:1.0:am:password" />
                </list>
            </property>
</bean>

Thanks!

Hong

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170323/788999ad/attachment.html>