IDP 3.3.1 MFA issue

[Hong Ye]

Here is what have now, but still doesn’t work

<bean id="authn/RemoteUser" parent="shibboleth.AuthenticationFlow"
            p:nonBrowserSupported="false" >
           <property name="supportedPrincipals">
           <list>
            <bean parent="shibboleth.SAML2AuthnContextClassRef"
                        c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" />
            </list>
            </property>
</bean>
<bean id="authn/Duo" parent="shibboleth.AuthenticationFlow"
                p:forcedAuthenticationSupported="true"
                p:nonBrowserSupported="false">

            <property name="supportedPrincipals">
                <list>
                     <bean parent="shibboleth.SAML2AuthnContextClassRef"
                         c:classRef="http://cornell.edu/mfa" />
                     <bean parent="shibboleth.SAML1AuthenticationMethod"
                         c:method="http://cornell.edu/mfa" />
                </list>
            </property>
</bean>

<bean id="authn/MFA" parent="shibboleth.AuthenticationFlow"
                p:passiveAuthenticationSupported="true"
                p:forcedAuthenticationSupported="true">

      <property name="supportedPrincipals">
      <list>
             <bean parent="shibboleth.SAML2AuthnContextClassRef"
                         c:classRef="http://cornell.edu/mfa" />
             <bean parent="shibboleth.SAML2AuthnContextClassRef"
                        c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" />
      </list>
      </property>
 </bean>



On Mar 23, 2017, at 4:58 PM, Cantor, Scott <cantor.2 at osu.edu<mailto:cantor.2 at osu.edu>> wrote:

I tried the solution posted by Scott Koranda in that thread. It still doesn’t
work for me. Our primary authentication is authn/RemoteUser. I’m sure I’m
missing something in my configuration, but I can't’ figured it out.

Your supportedPrincipal collections don't make any sense.

The Duo method is claiming to support "http://cornell.edu/mfa" but your MFA method is not consistent with that and is for some reason claiming to support IPAddress and Password contexts, probably because the default example uses those. You can't leave things defaulted, you have to adjust them all appropriately for your local choices.

The MFA flow needs to "support" all of the possible values you want to have it respond to, generally by unioning the values supported by the individual flows it's going to be orchestrating. Most of the time that's enough to get things operating correctly.

You also didn't show what your RemoteUser flow's supportedPrincipals are, but collectively it's not consistent or correct.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170323/f8d033ce/attachment-0001.html>