How to terminate MFA flow with an error?

[Losen, Stephen C (scl)]

Hi Andy,

Yes, that is the purpose of shibboleth.LocalEventMap.

And you will also want to edit .../messages/messages.properties to specify the text to put into the error.vm view for your DuoRequired event. The distributed messages.properties file is empty.  You put stuff into it to override/augment the system file .../system/messages/messages.properties so look at this file for inspiration (but don't change it).

Stephen C. Losen
ITS - Systems and Storage
University of Virginia
scl at virginia.edu    434-924-0640


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Andrew Morgan
Sent: Tuesday, January 08, 2019 1:47 AM
To: Shib Users <users at shibboleth.net>
Subject: RE: How to terminate MFA flow with an error?

On Mon, 7 Jan 2019, Andrew Morgan wrote:

> I'm trying to terminate the MFA flow with an error and display a page to the 
> user, similar to this old thread, when the SP requires Duo but the user 
> hasn't enrolled yet.
>
> I set the event in conf/authn/mfa-authn-config.xml inside the 
> "heckSecondFactor" script:
>
>  mfaCtx.setEvent('DuoRequired');
>  nextFlow = null;
>
> I added states and transitions to conf/authn/authn-events-flow.xml:
>
>    <end-state id="DuoRequired" />
>
>    <global-transitions>
>        <transition on="DuoRequired" to="DuoRequired" />
>        <transition on="#{!'proceed'.equals(currentEvent.id)}" 
> to="InvalidEvent" />
>    </global-transitions>
>
> I added some messages for this to messages/messages.properties:
>
> # Duo messages
> DuoRequired = duo-required
> duo-required.title = Duo Authentication Required
> duo-required.message = You must sign-up for Duo 2-Step authentication to 
> proceed.
>
> For CAS authentication, when I authenticate as a user without Duo for an SP 
> that requires Duo, I get the error.vm view with my messages.  Yay!
>
> For SAML authentication, a SAML response is generated with an error code:
>
>  <saml2p:Status>
>    <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Responder" 
> />
>    <saml2p:StatusMessage>An error occurred.</saml2p:StatusMessage>
>  </saml2p:Status>
>
> How can I get the SAML authentication to present an error page to the user at 
> the IDP?  Do I have to create an intercept?

After further researching, I stumbled across this comment on the 
ContextCheckInterceptConfiguration wiki page:

"If you want to support one or more custom events, you'll need to add the 
event(s) to conf/intercept/intercept-events-flow.xml. The default file 
includes a commented example for an event called "MyCustomEvent". Then 
you'll need to add that event in conf/errors.xml if you want it handled 
with a local error page."

Will creating an entry in the shibboleth.LocalEventMap list in errors.xml 
for DuoRequired cause the error.vm view to be used instead of a SAML 
response?

Thanks,
 	Andy
-- 
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net