MFA - Relying Party

[Cantor, Scott]

On 10/4/18, 3:48 AM, "users on behalf of Joshua Brodie" <users-bounces at shibboleth.net on behalf of josbrodie at gmail.com> wrote:

> For Duo MFA, in the 'relying-party.xml' file, I have 2 entityIds declared as below --- without the "
> p:authenticationFlows="MFA"

That's a very low level feature and all it does is override the value of the property that normally enables login flows for the system globally, and I'm sure MFA is one of the flows the property is enabling (usually it's the only one).

Selection of login methods is handled through the abstraction of custom Principal types that represent (in SAML 2) the AuthnContextClassRef notion that is supported natively in the protocol. You don't enable flows, you specify requirements and map the flows to the requirements they support. The supportedPrincipals property on the flow descriptors and the defaultAuthenticationMethods property on the relying party definitions are the two settings that are used to drive selection.

-- Scott