Best way to enable MFA globally?

[McKean, Brandon Scott - mckeanbs]

Hi Everyone,


We're looking to force Duo usage for everything starting in a few months. I'm wondering what the recommended way of handling this configuration is. My best guess is that it would be done in the relying-party.xml using something like:


<bean parent="SAML2.SSO">

<property name="defaultAuthenticationMethods">

<list>

<ref bean="mfa"/>

</list>

</property

</bean>


.. by default and for any overrides already specified.


Though I suspect it could also be done in mfa-authn-config.xml by always setting nextFlow to "authn/Duo".


Any guidance on this would be appreciated.


Thanks,


--Brandon
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180129/06da91f1/attachment.html>