Duo in Shib 3.3

[Clayton]

Thanks all.
The need to configure MFA so that it can require multiple authentication
tokens makes perfect sense.  
In my case it'll require both the regular password auth and auth from Duo.


Looking at the [
https://wiki.shibboleth.net/confluence/display/IDP30/ShibbolethSSOConfiguration
]ShibbolethSSOConfig and the [
https://wiki.shibboleth.net/confluence/display/IDP30/SAML2SSOConfiguration
]SAML2SSOConfig I see some syntax that I don't understand:


Examples of defaultAuthenticationMethods property
<!-- NOTE: these example.org constants are examples and are not suitable
for real use. -->
<bean id="MFASAML2Principal" parent="shibboleth.SAML2AuthnContextClassRef"
	c:_0="http://example.org/ac/classes/mfa" />
<bean id="MFASAML1Principal" parent="shibboleth.SAML1AuthenticationMethod"
	c:_0="http://example.org/ac/classes/mfa" />


What is up with "c:_0"?  I see [
http://shibboleth.1660669.n2.nabble.com/Forcing-Duo-by-Service-Provider-td7632287.html
]a thread mostly between Brandon McKean and Scott from Mar 2017 where
Brandon seems to use "c:classRef" instead.  That thread's especially
interesting to me because he was trying to do exactly what I am.

Also, out of curiosity, are "MFASAML2Principal" and "MFASAML1Principal"
set in stone? Or could I use any string for this if I added it to the
right config files?

--Clayton


"Shib Users users-at-shibboleth.net |Shib|" <3unnche4it at sneakemail.com> on
Friday, June 22, 2018 at 2:20 PM -0400 wrote:
>On 6/22/18, 2:13 PM, "users on behalf of Losen, Stephen C. (scl)"  wrote:
>
>> You need to configure Multi Factor Authn (MFA). You probably want it to
>run Password Authn first and then run Duo. 
>> And of course you must configure Duo. If the IDP is currently running
>Password directly, then run MFA instead.
>
>Relevant material being [1].
>
>The reason you don't see the "big picture" in the Duo topic is that Duo
>isn't a stand-alone solution, it's a single factor, not MFA. That tells
>you how to configure Duo to work but not how to combine it with other
>factors, and that's what most people want to do.
>
>The default examples for MFA that the software ships with are more than a
>simple use case for just running Password+Duo actually require but
>they're easily reducible to that. The Duo flow will automatically make
>use of the identity produced by the Password flow if that's the use case
>and there's nothing much to configure for that to work.
>
>-- Scott
>
>[1]
>https://wiki.shibboleth.net/confluence/display/IDP30/MultiFactorAuthnConfiguration
>
>-- 
>For Consortium Member technical support, see
>https://wiki.shibboleth.net/confluence/x/coFAAg


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180622/79cf5a41/attachment.html>