SSO does not work properly when using MFA

[Noriyuki TAKEI]

Hi,All.

I'm using MFA flow which has 2 flows(password-authn-flow and TOTP
Flow).The former is a built-in flow in Shibboleth and the latter is one
which is fully developed in house based on RFC6238.

I have one problem.In this case, SSO does not work properly.

The details are as follows.

1.At first, I access SP1.
2.And then, I'm redirected to Shibboleth Idp.
3.I enter ID and password in password-authn-flow.
4.I enter Time-Based One-time password in TOTP flow.
5.I'm redirected to SP1
6.I access SP2.
7.I expected that I'll be redirected to SP2, but I was redirected to the
login screen.

However, if I modify the MFA Flow mentioned above(password-authn-flow and
TOTP Flow) to password-authn-flow and
ipaddress-authn-flow,SSO works properly.

I found the logs below when SSO worked properly.
[XXX.XXX.XXX.XXX] - jsessionid[0032E0935121A65D9B4F2985F0950407] - Profile
Action UpdateSessionWithAuthenticationResult: Updating activity time on
reused AuthenticationResult for flow authn/MFA in existing session

However, I did not find logs as mentioned above when SSO did not work
properly.

I guess that reusing authentication results do not work properly.

The configurations and environments are as follows.
- Shibboleth Idp Version: 4.0.1
- idp.authn.favorSSO=true
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20200928/8927fd00/attachment.htm>