MFA - Relying Party

[Joshua Brodie]

In my attempt for brevity, I missed out part of the bean -- added below in
case pertinent.

MFA is generated for both the entityIDs foo and bar even without the "
p:authenticationFlows="MFA"(I checked and double checked -- we do not have
over-rides elsewhere in 'mfa-authn-config.xml').

<bean p:id="NonMFA" parent="RelyingPartyByName">

        <constructor-arg name="relyingPartyIds">

            <list>

                <value>https://foo</value>

                <value>https://bar</value>

            </list>

        </constructor-arg>

        <property name="profileConfigurations">

            <list>

                <bean parent="SAML2.SSO"

                      p:postAuthenticationFlows="password-update"

                      p:nameIDFormatPrecedence=
"#{{'urn:oasis:names:tc:SAML:2.0:nameid-format:unspecified'}}" />

                <bean parent="SAML2.Logout" />

            </list>

        </property>

    </bean>

On Thu, 4 Oct 2018 at 00:47, Joshua Brodie <josbrodie at gmail.com> wrote:

> For Duo MFA, in the 'relying-party.xml' file, I have 2 entityIds declared
> as below --- without the "
> p:authenticationFlows="MFA" -- however it is still triggering the MFA. Is
> there something I am missing (3.3.3)?
>
>
> <bean p:id="NonMFA" parent="RelyingPartyByName">
>
>         <constructor-arg name="relyingPartyIds">
>
>             <list>
>
>                 <value>https://foo</value>
>
>                 <value>https://bar</value>
>
>             </list>
>
>         </constructor-arg>
>
>         <property name="profileConfigurations">
>
>             <list>
>
>                 <bean parent="SAML2.SSO" />
>
>                 <bean parent="SAML2.Logout" />
>
>             </list>
>
>         </property>
>
>     </bean>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20181004/94327b00/attachment.html>