How to terminate MFA flow with an error?

[Losen, Stephen C. (scl)]

Hi folks,

First I want to thank Scott for all his help. He is an indispensable resource.

Carefully rereading the wiki, I conclude that the MFA transition map (and my associated script) can ONLY return authn flow names (or null).  In particular, the transition map cannot cause the MFA flow to terminate with a specified event.

So I will pursue a different approach.  In my MFA transition script I will check for the "duo-enabled" attr and if true, then return "authn/Duo", otherwise null.

I will define a context check intercept to check the duo-deadline attribute, and if it has passed, display an error page with a link to our Duo signup app.

The IDP will automatically handle the case where the SP requires Duo and Duo was not used.

Efficiency concern: does the IDP run the attribute resolver multiple times or does it cache?  The IDP will reference attributes in at least three places: MFA transition, context check intercept, attribute filter.

Stephen C. Losen
ITS - Systems and Storage
University of Virginia
scl at virginia.edu    434-924-0640


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Thursday, May 17, 2018 6:44 PM
To: Shib Users <users at shibboleth.net>
Subject: RE: How to terminate MFA flow with an error?

> I have this logic coded in a MFA script, but I'm not sure what is the best way to
> handle the "error case" where the first factor (Password) alone is not sufficient,
> but the user is not registered with Duo.

I guess that depends what you want it to do, but if you're asking a more scoped question (i.e. what the subject line explicitly says), it's documented, https://wiki.shibboleth.net/confluence/display/IDP30/AuthenticationConfiguration, CustomEvents

You can return any event you want, the rest is custom error handling. The only hassle is the bit about defining the event as a legal result of the authentication flow and that's the part it documents under that section.

> I have a rather ugly solution where the script sets the next flow to
> "authn/error" (undefined flow) and that definitely stops MFA dead in its tracks.
> However, the IDP itself does not display an error (which I could customize) and
> instead it responds to the SP with an error, so your browser shows a cryptic
> error from the SP.

There are people who believe that the IdP's job is to do what it's asked, and if it's asked for MFA and can't do so, the default behavior is to respond with a status saying so. That is what the standard more or less encourages so it's the default any time authentication fails and the IdP regains control.

-- Scott

-- 
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net