mfaCtx.isAcceptable() and entity tags

[Paul B. Henson]

I'm still fiddling around with my mfa check script while trying to
decide how best to handle our requirements. I'm trying to test the
metadata driven approach of overriding defaultAuthenticationMethods with
the following filter:

        <MetadataFilter xsi:type="EntityAttributes">
                <saml:Attribute Name="http://shibboleth.net/ns/profiles/defaultAuthenticationMethods">
                        <saml:AttributeValue>https://refeds.org/profile/mfa</saml:AttributeValue>
                </saml:Attribute>
                <Entity>https://sp.test.calstate.edu/shibboleth-sp</Entity>
        </MetadataFilter>

However, in the script, mfaCtx.isAcceptable() is returning true after
initial password auth?

In the debug log, I see:

2020-09-09 22:28:10,365 - 10.104.223.197/node0wef3upsvjduo1xfyv93zgc7zj0 - DEBUG [net.shibboleth.idp.saml.profile.config.AbstractMetadataDrivenConfigurationLookupStrategy:322] - No applicable mapped tag, applying default strategy for 'defaultAuthenticationMethods'
2020-09-09 22:28:10,366 - 10.104.223.197/node0wef3upsvjduo1xfyv93zgc7zj0 - DEBUG [net.shibboleth.idp.authn.impl.InitializeRequestedPrincipalContext:152] - Profile Action InitializeRequestedPrincipalContext: Profile configuration did not supply any default authentication methods

which leads me to believe I'm doing something wrong, but I'm not sure 
what 8-/.

It looks like the tag is being applied?

2020-09-09 22:28:10,002 - / - INFO [org.opensaml.saml.metadata.resolver.filter.impl.EntityAttributesFilter:238] - Adding new EntityAttribute (http://shibboleth.net/ns/profiles/defaultAuthenticationMethods) to EntityDescriptor (https://sp.test.calstate.edu/shibboleth-sp)

and that's the SP being processed:

2020-09-09 22:28:09,602 - 10.104.223.197/node0wef3upsvjduo1xfyv93zgc7zj0 - DEBUG [net.shibboleth.idp.saml.profile.impl.InitializeRelyingPartyContextFromSAMLPeer:131] - Profile Action InitializeRelyingPartyContextFromSAMLPeer: Attaching RelyingPartyContext based on SAML peer https://sp.test.calstate.edu/shibboleth-sp

What am I missing? Thanks...


-- 
Paul B. Henson  |  (909) 979-6361  |  http://www.cpp.edu/~henson/
Operating Systems and Network Analyst  |  henson at cpp.edu
California State Polytechnic University  |  Pomona CA 91768