Duo in Shib 3.3

[Clayton]

I never got to the point of triggering Duo for every SP - I found the
setting that let's us enable it per-SP which is where I was trying to go
in the first place.

In relying-party.xml there's this section:
	 <util:list id="shibboleth.RelyingPartyOverrides">

Within it there's a bean for each SP for which you want to override
defaults.
The part in red is what made-it-go for me

<bean parent="RelyingPartyByName"
c:relyingPartyIds="#{{'http://the.sp.com/theirSPEntityID'}}">
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO" p:encryptAssertions="true"
p:encryptNameIDs="true"
p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:2.0:nameid-format:OurCustomFormat1"
p:authenticationFlows="#{{'MFA'}}">
                    </bean>
                </list>
            </property>
</bean>

It's all there in Shib3's Relying Party documentation.

I think [
https://wiki.shibboleth.net/confluence/display/IDP30/ShibbolethSSOConfiguration
]the examples I was looking at achieved this a different way.  They were
defining "MFASAML2Principal" beans and then referencing them in different
places.  I don't understand the advantage of going that route.  More
re-usable objects I guess? Maybe useful if you're also expecting some SP's
to request MFA occaisonally?

--Clayton



Clayton Burton on Friday, June 22, 2018 at 3:48 PM -0400 wrote:
>Thanks all.
>The need to configure MFA so that it can require multiple authentication
>tokens makes perfect sense.  
>In my case it'll require both the regular password auth and auth from Duo.
>
>
>Looking at the [
>https://wiki.shibboleth.net/confluence/display/IDP30/ShibbolethSSOConfiguration
>]ShibbolethSSOConfig and the [
>https://wiki.shibboleth.net/confluence/display/IDP30/SAML2SSOConfiguration
>]SAML2SSOConfig I see some syntax that I don't understand:
>
>
>Examples of defaultAuthenticationMethods property
><!-- NOTE: these example.org constants are examples and are not suitable
>for real use. -->
><bean id="MFASAML2Principal" parent="shibboleth.SAML2AuthnContextClassRef"
>	c:_0="http://example.org/ac/classes/mfa" />
><bean id="MFASAML1Principal" parent="shibboleth.SAML1AuthenticationMethod"
>	c:_0="http://example.org/ac/classes/mfa" />
>
>
>What is up with "c:_0"?  I see [
>http://shibboleth.1660669.n2.nabble.com/Forcing-Duo-by-Service-Provider-td7632287.html
>]a thread mostly between Brandon McKean and Scott from Mar 2017 where
>Brandon seems to use "c:classRef" instead.  That thread's especially
>interesting to me because he was trying to do exactly what I am.
>
>Also, out of curiosity, are "MFASAML2Principal" and "MFASAML1Principal"
>set in stone? Or could I use any string for this if I added it to the
>right config files?
>
>--Clayton
>
>
>"Shib Users users-at-shibboleth.net |Shib|" <3unnche4it at sneakemail.com>
>on Friday, June 22, 2018 at 2:20 PM -0400 wrote:
>On 6/22/18, 2:13 PM, "users on behalf of Losen, Stephen C. (scl)"  wrote:
>
>> You need to configure Multi Factor Authn (MFA). You probably want it to
>run Password Authn first and then run Duo. 
>> And of course you must configure Duo. If the IDP is currently running
>Password directly, then run MFA instead.
>
>Relevant material being [1].
>
>The reason you don't see the "big picture" in the Duo topic is that Duo
>isn't a stand-alone solution, it's a single factor, not MFA. That tells
>you how to configure Duo to work but not how to combine it with other
>factors, and that's what most people want to do.
>
>The default examples for MFA that the software ships with are more than a
>simple use case for just running Password+Duo actually require but
>they're easily reducible to that. The Duo flow will automatically make
>use of the identity produced by the Password flow if that's the use case
>and there's nothing much to configure for that to work.
>
>-- Scott
>
>[1]
>https://wiki.shibboleth.net/confluence/display/IDP30/MultiFactorAuthnConfiguration
>
>-- 
>For Consortium Member technical support, see
>https://wiki.shibboleth.net/confluence/x/coFAAg
>


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20180622/008da768/attachment.html>