How to terminate MFA flow with an error?

[Andrew Morgan]

Any thoughts about whether one of these events should go in the audit log? 
That is a setting in errors.xml.  I end with an "empty" audit log entry, 
like this:

INFO [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstLDAP:152] - Profile Action ValidateUsernamePasswordAgainstLDAP: Login by 'morgana' succeeded
WARN [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event occurred while processing the request: DuoRequired
INFO [Shibboleth-Audit.SSO:275] - 20190108T173709Z|10.214.121.42|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_218c1cf573a12d87367d08a3520ece0113718e28d5|http://people.oregonstate.edu/~morgan/simplesaml/module.php/saml/sp/metadata.php/default-sp|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://login.oregonstate.edu/idp-dev/shibboleth||||||||

It seems semi-useful because then I'll know which service the person was 
trying to access, but maybe it will throw off stats if I analyze the logs.

The defaults in errors.xml log for ContextCheckDenied, 
AttributeReleaseRejected, and TermsRejected.  It does not log for 
RuntimeException.  Is there a reason for those choices?

Thanks,
 	Andy

On Tue, 8 Jan 2019, Andrew Morgan wrote:

> Yep, that worked!
>
> Thanks,
> 	Andy
>
>
> On Tue, 8 Jan 2019, Losen, Stephen C (scl) wrote:
>
>> Hi Andy,
>> 
>> Yes, that is the purpose of shibboleth.LocalEventMap.
>> 
>> And you will also want to edit .../messages/messages.properties to specify 
>> the text to put into the error.vm view for your DuoRequired event. The 
>> distributed messages.properties file is empty.  You put stuff into it to 
>> override/augment the system file .../system/messages/messages.properties so 
>> look at this file for inspiration (but don't change it).
>> 
>> Stephen C. Losen
>> ITS - Systems and Storage
>> University of Virginia
>> scl at virginia.edu    434-924-0640
>> 
>> 
>> -----Original Message-----
>> From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Andrew 
>> Morgan
>> Sent: Tuesday, January 08, 2019 1:47 AM
>> To: Shib Users <users at shibboleth.net>
>> Subject: RE: How to terminate MFA flow with an error?
>> 
>> On Mon, 7 Jan 2019, Andrew Morgan wrote:
>> 
>>> I'm trying to terminate the MFA flow with an error and display a page to 
>>> the
>>> user, similar to this old thread, when the SP requires Duo but the user
>>> hasn't enrolled yet.
>>> 
>>> I set the event in conf/authn/mfa-authn-config.xml inside the
>>> "heckSecondFactor" script:
>>>
>>>  mfaCtx.setEvent('DuoRequired');
>>>  nextFlow = null;
>>> 
>>> I added states and transitions to conf/authn/authn-events-flow.xml:
>>>
>>>    <end-state id="DuoRequired" />
>>>
>>>    <global-transitions>
>>>        <transition on="DuoRequired" to="DuoRequired" />
>>>        <transition on="#{!'proceed'.equals(currentEvent.id)}"
>>> to="InvalidEvent" />
>>>    </global-transitions>
>>> 
>>> I added some messages for this to messages/messages.properties:
>>> 
>>> # Duo messages
>>> DuoRequired = duo-required
>>> duo-required.title = Duo Authentication Required
>>> duo-required.message = You must sign-up for Duo 2-Step authentication to
>>> proceed.
>>> 
>>> For CAS authentication, when I authenticate as a user without Duo for an 
>>> SP
>>> that requires Duo, I get the error.vm view with my messages.  Yay!
>>> 
>>> For SAML authentication, a SAML response is generated with an error code:
>>>
>>>  <saml2p:Status>
>>>    <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Responder"
>>> />
>>>    <saml2p:StatusMessage>An error occurred.</saml2p:StatusMessage>
>>>  </saml2p:Status>
>>> 
>>> How can I get the SAML authentication to present an error page to the user 
>>> at
>>> the IDP?  Do I have to create an intercept?
>> 
>> After further researching, I stumbled across this comment on the
>> ContextCheckInterceptConfiguration wiki page:
>> 
>> "If you want to support one or more custom events, you'll need to add the
>> event(s) to conf/intercept/intercept-events-flow.xml. The default file
>> includes a commented example for an event called "MyCustomEvent". Then
>> you'll need to add that event in conf/errors.xml if you want it handled
>> with a local error page."
>> 
>> Will creating an entry in the shibboleth.LocalEventMap list in errors.xml
>> for DuoRequired cause the error.vm view to be used instead of a SAML
>> response?
>> 
>> Thanks,
>> 	Andy
>> -- 
>> For Consortium Member technical support, see 
>> https://wiki.shibboleth.net/confluence/x/coFAAg
>> To unsubscribe from this list send an email to 
>> users-unsubscribe at shibboleth.net
>> -- 
>> For Consortium Member technical support, see 
>> https://wiki.shibboleth.net/confluence/x/coFAAg
>> To unsubscribe from this list send an email to 
>> users-unsubscribe at shibboleth.net
>> 
> -- 
> For Consortium Member technical support, see 
> https://wiki.shibboleth.net/confluence/x/coFAAg
> To unsubscribe from this list send an email to 
> users-unsubscribe at shibboleth.net
>