Forcing Duo by Service Provider

[Michael A Grady]

> On Mar 29, 2017, at 7:35 PM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> 
> On 3/29/17, 8:29 PM, "users on behalf of Andrew Morgan" <users-bounces at shibboleth.net on behalf of morgan at orst.edu> wrote:
> 
>> On a related topic, can this be done for CAS services in Shibboleth?  Is 
>> there a way to apply an override, perhaps by groupID, for a CAS service? 
>> I'm not aware of any way for a CAS service to request MFA itself.
> 
> Yes, Marvin or I at some point fixed the CASLoginConfiguration bean to inherit appropriately so you can set the defaultAuthenticationMethods property. Since there's no native CAS object to present the authentication used, we copied the AuthnContextClassRefPrincipal type from the SAML 2 bean so you just use that. Since there's no inbound request capability, setting it is defintive / not overrideable.
> 
> -- Scott

And you can do the same "list multiple ones" and do it by user if you want. I configured a set of CAS services in the CAS config, where some had 'p:group="2FAselectUsers"', and some had  'p:group="2FA";, and then in relying-party.xml the following. Probably don't need the  p:disallowedFeatures-ref="SAML2.SSO.FEATURE_AUTHNCONTEXT", given there isn't a way for the request to contain a requested one, but it also doesn't (seem to) hurt anything.

        <!-- CAS must use Duo services -->
        <bean id="casMfaGroup" parent="RelyingPartyByGroup" c:groupNames="2FA">
            <property name="profileConfigurations">
                <list>
                    <bean parent="CAS.LoginConfiguration" 
                                                          p:disallowedFeatures-ref="SAML2.SSO.FEATURE_AUTHNCONTEXT">
                        <property name="defaultAuthenticationMethods">
                            <list>
                              <ref bean="MfaPrincipal" />
                            </list>
                        </property>
                    </bean>
                    <ref bean="CAS.ValidateConfiguration" />
                </list>
            </property>
        </bean>

        <!-- CAS: select users  must use Duo services -->
        <bean id="casMfaSelectUsersGroup" parent="RelyingPartyByGroup" c:groupNames="2FAselectUsers">
            <property name="profileConfigurations">
                <list>
                    <bean parent="CAS.LoginConfiguration" 
                                                          p:disallowedFeatures-ref="SAML2.SSO.FEATURE_AUTHNCONTEXT">
                        <property name="defaultAuthenticationMethods">
                            <list>
                              <ref bean="MfaPrincipal" />
                              <ref bean="PasswordPrincipal" />
                            </list>
                        </property>
                    </bean>
                    <ref bean="CAS.ValidateConfiguration" />
                </list>
            </property>
        </bean>
    </util:list>

and then the resolver attribute decided if the user was in the group that had to do 2FA for selected SPs.

That does bring up the question -- can one access that CAS group name in the attribute-resolver, and if so, as what?

--
Michael A. Grady
IAM Architect, Unicon, Inc.



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170329/c6bf23b7/attachment.html>