Shib IdP 3.3 MFA - AuthnContextClassRef issue

Tue Mar 28 09:41:16 EDT 2017

Hi,

I've been working on updating the shib-mfa-u2f-auth plugin to fully support
IdP v3.3 and the MFA flow. The plugin works but with one little exception,
I can't get the MFA flow to send the correct AuthnContextClassRef back in
the SAML response. Not even when the SP requests the specific one that I'd
expect. I'm not sure if this is a configuration error or if I'm missing a
vital part in my code for this to work. I'm expecting "http://stderr.eu/u2f"
but I get
"urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport". I'm
having a hunch that the problem might be related to the use of my
U2fPrincipal and populateSubject(), but I'm not sure.

This is my current configuration which is pretty straight forward. Only the
MFA flow is enabled in idp.properties.

general-auth.xml:

        <bean id="authn/MFA" parent="shibboleth.AuthenticationFlow"
                p:passiveAuthenticationSupported="true"
                p:forcedAuthenticationSupported="true">

            <property name="supportedPrincipals">
                <list>
                    <bean parent="shibboleth.SAML2AuthnContextClassRef"
                       c:classRef="http://stderr.eu/u2f" />
                    <bean parent="shibboleth.SAML2AuthnContextClassRef"

c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"
/>
                    <bean parent="shibboleth.SAML2AuthnContextClassRef"

c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:Password" />
                </list>
            </property>
        </bean>

        <bean id="authn/U2f" parent="shibboleth.AuthenticationFlow"
          p:passiveAuthenticationSupported="true"
p:forcedAuthenticationSupported="true">
        <property name="supportedPrincipals">
            <util:list>
                <bean parent="shibboleth.SAML2AuthnContextClassRef"
                      c:classRef="http://stderr.eu/u2f" />
                <bean parent="shibboleth.SAML1AuthenticationMethod"
                      c:method="http://stderr.eu/u2f" />
            </util:list>
        </property>
    </bean>

mfa-authn-config.xml:

 <entry key="">
            <bean parent="shibboleth.authn.MFA.Transition"
p:nextFlow="authn/Password" />
 </entry>
 <entry key="authn/Password">
            <bean parent="shibboleth.authn.MFA.Transition"
p:nextFlow="authn/U2f" />
 </entry>

A few log entries:

2017-03-28 13:09:46,920 - INFO
[eu.stderr.shibboleth.idp.u2f.authn.impl.ValidateResponse:129] - Profile
Action ValidateResponse: U2F login successful
2017-03-28 13:09:46,922 - DEBUG
[net.shibboleth.idp.authn.AbstractValidationAction:341] - Profile Action
ValidateResponse: Adding custom Principal(s) defined on underlying flow
descriptor
2017-03-28 13:09:46,926 - DEBUG
[eu.stderr.shibboleth.idp.u2f.authn.impl.ValidateResponse:142] - Profile
Action ValidateResponse: subjects
[AuthnContextClassRefPrincipal{authnContextClassRef=http://stderr.eu/u2f}
, AuthenticationMethodPrincipal{authnMethod=http://stderr.eu/u2f}]
2017-03-28 13:09:46,961 - DEBUG
[net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:184] -
Profile Action TransitionMultiFactorAuthentication: Preserving
authentication result from 'authn/U2f' flow
2017-03-28 13:09:46,962 - DEBUG
[net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:197] -
Profile Action TransitionMultiFactorAuthentication: Applying MFA transition
rule to exit state 'authn/U2f'
2017-03-28 13:09:46,962 - DEBUG
[net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:219] -
Profile Action TransitionMultiFactorAuthentication: MFA flow completing
with event 'proceed'
2017-03-28 13:09:46,971 - DEBUG
[net.shibboleth.idp.authn.impl.FinalizeMultiFactorAuthentication:193] -
Profile Action FinalizeMultiFactorAuthentication: MFA complete, producing
merged result
2017-03-28 13:09:46,983 - DEBUG
[net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext:79] -
Profile Action PopulateSubjectCanonicalizationContext: Installing 2
canonicalization flows into SubjectC
anonicalizationContext
2017-03-28 13:09:46,984 - DEBUG
[net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] -
Profile Action SelectSubjectCanonicalizationFlow: Checking canonicalization
flow c14n/x500 for applicability
...
2017-03-28 13:09:46,985 - DEBUG
[net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:106] -
Profile Action SelectSubjectCanonicalizationFlow: Canonicalization flow
c14n/x500 was not applicable to this
 request
2017-03-28 13:09:46,985 - DEBUG
[net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] -
Profile Action SelectSubjectCanonicalizationFlow: Checking canonicalization
flow c14n/simple for applicabili
ty...
2017-03-28 13:09:46,986 - DEBUG
[net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:83] -
Profile Action SelectSubjectCanonicalizationFlow: Selecting
canonicalization flow c14n/simple
2017-03-28 13:09:46,994 - DEBUG
[net.shibboleth.idp.authn.AbstractSubjectCanonicalizationAction:226] -
Profile Action SimpleSubjectCanonicalization: trimming whitespace of input
string 'user-2'
2017-03-28 13:09:47,014 - DEBUG
[net.shibboleth.idp.authn.impl.FinalizeAuthentication:137] - Profile Action
FinalizeAuthentication: Canonical principal name was established as 'user-2'
2017-03-28 13:09:47,015 - DEBUG
[net.shibboleth.idp.authn.impl.FinalizeAuthentication:242] - Profile Action
FinalizeAuthentication: Checking result for compatibility with operator
'exact' and principal 'urn:oasis
:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport'
2017-03-28 13:09:47,015 - DEBUG
[net.shibboleth.idp.authn.principal.PrincipalEvalPredicateFactoryRegistry:82]
- Registry located predicate factory of type
'net.shibboleth.idp.authn.principal.impl.ExactPrincipalEv
alPredicateFactory' for principal type 'class
net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal' and
operator 'exact'
2017-03-28 13:09:47,016 - DEBUG
[net.shibboleth.idp.authn.impl.FinalizeAuthentication:262] - Profile Action
FinalizeAuthentication: Principal
'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport' in
 authentication result satisfies request for principal
'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport'

Any help pointing me in the right direction would be very much appreciated.

Thanks!

Best regards,
Stefan
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170328/ca032bec/attachment-0001.html>