MFA using metadata to control if its required

[Lipscomb, Gary]

Hi Scott,

Shib IdP 3.4.4
Tomcat 7
RHEL 7

I have these 2 segments in relyingparty.xml plus other overrides.   We use a metadata tag in an aggregation of SP metadata to determine if consent release is required. This SP falls into the " csu.NoUserConsentRelyingPartybyTag" override.


1. relyingparty.xml

<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:context="http://www.springframework.org/schema/context"
       xmlns:util="http://www.springframework.org/schema/util"
       xmlns:p="http://www.springframework.org/schema/p"
       xmlns:c="http://www.springframework.org/schema/c"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute"
       xmlns:saml="urn:oasis:names:tc:SAML:assertion"
       xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
                           http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context.xsd
                           http://www.springframework.org/schema/util http://www.springframework.org/schema/util/spring-util.xsd"

       default-init-method="initialize"
       default-destroy-method="destroy">

    <bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty">
        <property name="profileConfigurations">
            <list>
                <bean parent="Shibboleth.SSO" p:postAuthenticationFlows="#{{'member', 'attribute-release'}}" />
                <ref bean="SAML1.AttributeQuery" />
                <ref bean="SAML1.ArtifactResolution" />
                <bean parent="SAML2.SSO.MDDriven" p:postAuthenticationFlows="#{{'member', 'attribute-release'}}" />
                <ref bean="SAML2.ECP" />
                <ref bean="SAML2.Logout" />
                <ref bean="SAML2.AttributeQuery" />
                <ref bean="SAML2.ArtifactResolution" />
                <ref bean="Liberty.SSOS" />
            </list>
        </property>
    </bean>

<snip>

</snip>

        <bean id="csu.NoUserConsentRelyingPartybyTag" parent="RelyingPartyByTag">
             <constructor-arg name="candidates">
                 <list>
                    <bean id="noAttributeConsentRequired" parent="TagCandidate"
                          c:name="ConsentReleaseRequired"
                          c:format="urn:oasis:names:tc:SAML:2.0:attrname-format:basic"
                          p:values="NotRequired" />
                  </list>
             </constructor-arg>
            <property name="profileConfigurations">
                <list>
                    <ref bean="Shibboleth.SSO" />
                    <ref bean="SAML1.AttributeQuery" />
                    <ref bean="SAML1.ArtifactResolution" />
                    <bean parent="SAML2.SSO.MDDriven"  p:postAuthenticationFlows="member" />
                    <ref bean="SAML2.ECP" />
                    <ref bean="SAML2.Logout" />
                    <ref bean="SAML2.AttributeQuery" />
                    <ref bean="SAML2.ArtifactResolution" />
                </list>
            </property>
        </bean>

    </util:list>

</beans>


2.  metadata aggregation

<md:EntitiesDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata">
<md:Extensions xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute">
  <mdattr:EntityAttributes xmlns:saml="urn:oasis:names:tc:SAML:assertion">
    <saml:Attribute xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
      Name="ConsentReleaseRequired" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:basic">
      <saml:AttributeValue>NotRequired</saml:AttributeValue>
    </saml:Attribute>
  </mdattr:EntityAttributes>
</md:Extensions>

<md:EntityDescriptor  ID="_4d35faa8519eba5b810db7474072fbd851cdcfe2"
  entityID="https://staffdevel.csu.edu.au/shibboleth"
  xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata"
  xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"
  xmlns:mdattr="urn:oasis:names:tc:SAML:metadata:attribute"
  xmlns:xsd="http://www.w3.org/2001/XMLSchema"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
>

  <md:Extensions xmlns:alg="urn:oasis:names:tc:SAML:metadata:algsupport">
    <alg:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha512"/>
    <alg:DigestMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#sha384"/>
    <alg:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256"/>
    <alg:DigestMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#sha224"/>
    <alg:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/>
    <alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha512"/>
    <alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha384"/>
    <alg:SigningMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256"/>
    <alg:SigningMethod Algorithm="http://www.w3.org/2009/xmldsig11#dsa-sha256"/>
    <alg:SigningMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/>
    <alg:SigningMethod Algorithm="http://www.w3.org/2000/09/xmldsig#dsa-sha1"/>
    <mdattr:EntityAttributes>
        <saml:Attribute Name="http://shibboleth.net/ns/profiles/defaultAuthenticationMethods"
          NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
          <saml:AttributeValue>https://csu.edu.au/MFA_Required</saml:AttributeValue>
        </saml:Attribute>
        <!-- The disallowedFeatures setting is a bitmask, and 0x1 blocks SPs requesting authentication types. -->
        <saml:Attribute Name="http://shibboleth.net/ns/profiles/disallowedFeatures"
          NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri">
          <saml:AttributeValue>0x1</saml:AttributeValue>
        </saml:Attribute>
    </mdattr:EntityAttributes>
  </md:Extensions>

  <md:SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol urn:oasis:names:tc:SAML:1.1:protocol urn:oasis:names:tc:SAML:1.0:protocol">


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Tuesday, 3 March 2020 07:20
To: Shib Users <users at shibboleth.net>
Subject: Re: MFA using metadata to control if its required

On 3/2/20, 12:21 AM, "users on behalf of Lipscomb, Gary" <users-bounces at shibboleth.net on behalf of glipscomb at csu.edu.au> wrote:

> Can you point me in the right direction.

Most of the bits seems to be there; possibly you don't have anything wired up to support metadata driving this in relying-party.xml

-- Scott


-- 
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net