MFA with specific authnContextClassRef

[Shawn]

Hello,

I'm having a strange issue and assume I setup mfa incorrectly. Trying to use a certain authnContextClassRef to signify that 2nd factor is required.

The SP is requesting authnContextClassRef of https://refeds.org/profile/mfa and the idp errors with "urn:oasis:names:tc:SAML:2.0:status:NoAuthnContext" unless I add that classRef to supportedPrincipals of authn/Password, which is confusing to me. I didn't think that was needed and I think that would lead to mfaCtx.isAcceptable() always returning true?


idp.properties--------------------
idp.authn.flows= MFA


general-authn.xml------------------------
        <bean id="authn/Password" parent="shibboleth.AuthenticationFlow"
                p:passiveAuthenticationSupported="true"
                p:forcedAuthenticationSupported="true" />

        <bean id="authn/Duo" parent="shibboleth.AuthenticationFlow"
                p:forcedAuthenticationSupported="true"
                p:nonBrowserSupported="false">
            <property name="supportedPrincipals">
                <list>
                    <bean parent="shibboleth.SAML2AuthnContextClassRef" c:classRef="https://refeds.org/profile/mfa" />
                </list>
            </property>
        </bean>

        <bean id="authn/MFA" parent="shibboleth.AuthenticationFlow"
                p:passiveAuthenticationSupported="true"
                p:forcedAuthenticationSupported="true">
            <property name="supportedPrincipals">
                <list>
                   <bean parent="shibboleth.SAML2AuthnContextClassRef" c:classRef="https://refeds.org/profile/mfa" />
                    <bean parent="shibboleth.SAML2AuthnContextClassRef" c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" />
                    <bean parent="shibboleth.SAML2AuthnContextClassRef"
                        c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:Password" /> 
                </list>
            </property>
        </bean>

    <util:map id="shibboleth.AuthenticationPrincipalWeightMap">
          <entry>
            <key>
              <bean parent="shibboleth.SAML2AuthnContextClassRef" c:classRef="https://refeds.org/profile/mfa" />
            </key>
            <value>2</value>
          </entry>
        <entry>
            <key>
                <bean parent="shibboleth.SAML2AuthnContextClassRef" c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" />
            </key>
            <value>1</value>
        </entry>
    </util:map>



mfa-authn-config.xml----------------------------------

    <util:map id="shibboleth.authn.MFA.TransitionMap">
        <entry key="">
            <bean parent="shibboleth.authn.MFA.Transition" p:nextFlow="authn/Password" />
        </entry>

        <entry key="authn/Password">
            <bean parent="shibboleth.authn.MFA.Transition" p:nextFlowStrategy-ref="checkSecondFactor" />
        </entry>

        <!-- An implicit final rule will return whatever the final flow returns. -->
    </util:map>


    <bean id="checkSecondFactor" parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript"
        p:customObject-ref="shibboleth.AttributeResolverService">
        <constructor-arg>
            <value>
            <![CDATA[
                nextFlow = "authn/Duo";

                authCtx = input.getSubcontext("net.shibboleth.idp.authn.context.AuthenticationContext");
                mfaCtx = authCtx.getSubcontext("net.shibboleth.idp.authn.context.MultiFactorAuthenticationContext");

                if (mfaCtx.isAcceptable()) {
                    nextFlow=null;
                } else {
         ........etc
         ........etc
               }
              nextFlow;   // pass control to second factor or end with the first
            ]]>
            </value>
        </constructor-arg>
    </bean>