authn/MFA and authn/RemoteUser with two flavors of client certs

[Losen, Stephen C. (scl)]

Hi folks,


I am configuring MFA to first authenticate with username/password, or with a client cert.  The login form has a button that triggers authn/RemoteUser and the RemoteUser endpoint requires a client cert.  Then MFA runs Duo as the second factor.


We have two flavors of client certs and I can distinguish them via the cert issuer.  We have hardware token certs and "standard assurance" (file) certs.


We would like to bypass Duo when a hardware token is used.  I know how to do this in my MFA transition map script.  However, we want a hardware token to be "as good as" two factor with Duo. So if the SP requests an auth context class that ordinarily requires Duo, we want the hardware token cert to satisfy the request without running Duo. But a standard assurance cert should cause MFA to run Duo.


Is there some way for the MFA transition map script to modify an authn result so that when a token cert is used, Duo is bypassed and the the overall MFA result appears as if Duo was run?  Can I manipulate a data structure, and if so, which one and how?  (For specific details I can refer to the javadoc.)


Thanks,


Steve Losen
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180613/694c6690/attachment.html>