How to terminate MFA flow with an error?

[Andrew Morgan]

I'm trying to terminate the MFA flow with an error and display a page to 
the user, similar to this old thread, when the SP requires Duo but the 
user hasn't enrolled yet.

I set the event in conf/authn/mfa-authn-config.xml inside the 
"heckSecondFactor" script:

   mfaCtx.setEvent('DuoRequired');
   nextFlow = null;

I added states and transitions to conf/authn/authn-events-flow.xml:

     <end-state id="DuoRequired" />

     <global-transitions>
         <transition on="DuoRequired" to="DuoRequired" />
         <transition on="#{!'proceed'.equals(currentEvent.id)}" to="InvalidEvent" />
     </global-transitions>

I added some messages for this to messages/messages.properties:

# Duo messages
DuoRequired = duo-required
duo-required.title = Duo Authentication Required
duo-required.message = You must sign-up for Duo 2-Step authentication to proceed.

For CAS authentication, when I authenticate as a user without Duo for an 
SP that requires Duo, I get the error.vm view with my messages.  Yay!

For SAML authentication, a SAML response is generated with an error code:

   <saml2p:Status>
     <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Responder" />
     <saml2p:StatusMessage>An error occurred.</saml2p:StatusMessage>
   </saml2p:Status>

How can I get the SAML authentication to present an error page to the user 
at the IDP?  Do I have to create an intercept?

Thanks,
 	Andy



On Fri, 18 May 2018, Losen, Stephen C. (scl) wrote:

> Thank you very much Scott,
>
> This worked:
>
> event = "DuoSignup";
> nextFlow = null;
>
> ...
>
> mfaCtx.setEvent(event);
> nextFlow;
>
> Stephen C. Losen
> ITS - Systems and Storage
> University of Virginia
> scl at virginia.edu    434-924-0640
>
>
> -----Original Message-----
> From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
> Sent: Friday, May 18, 2018 12:31 PM
> To: Shib Users <users at shibboleth.net>
> Subject: RE: How to terminate MFA flow with an error?
>
> I spotted it, the way it's meant to be done is you signal "null" but set the Event property in the MultiFactorAuthenticationContext object in the tree and it will use that Event as the outcome.
>
> -- Scott
>
> -- 
> For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
> -- 
> For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
>