MFA fails canonicalization of 2nd factor when re-using existing session

[Grant Byers]

Hi,


Shibboleth IdP 3.4.7

We've implemented a conditional MFA flow that utilises SPENGO (if available) or Password (if not), then Duo as the 2nd factor. We enable only the MFA flow, use shibboleth.authn.MFA.TransitionMap with inline scripted conditional logic much like examples throughout the doco, then force 2nd factor for a single relying party. We also have an activation condition on SPNEGO that limits it to the same relying party. All other SPs continue to use single factor (Password). This all appears to work fine, except for the case where we login to one of the single factor services first, then attempt to login to the MFA service on a SPNEGO capable client. We can see from the logs that the SPNEGO flow succeeds and is canonicalized just fine. It then proceeds to the Duo flow, and that appears to succeed until the post-authentication canonicalization step. Some logs below for reference.

Being very new to the Shibboleth platform and having no one else to lean on, I'm pretty much stuck. I've been pouring over the documentation for days trying to find a solution to this problem, but at this point, I'm really not certain exactly what the problem is. Is anyone able to shed some light on how to debug this further, or suggest where I should focus my efforts? I'm happy to post some of my configuration snippets if that's required for context.


Thanks,
Grant


DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:227] - Profile Action TransitionMultiFactorAuthentication: MFA flow transition after 'proceed' event to 'authn/Duo' flow
DEBUG [net.shibboleth.idp.authn.duo.impl.ExtractDuoAuthenticationFromHeaders:189] - Profile Action ExtractDuoAuthenticationFromHeaders: Checking for Duo authentication headers
DEBUG [net.shibboleth.idp.authn.duo.impl.ExtractDuoAuthenticationFromHeaders:200] - Profile Action ExtractDuoAuthenticationFromHeaders: No Duo factor specified, auto method will not be attempted
INFO [net.shibboleth.idp.authn.duo.impl.ValidateDuoWebResponse:200] - Profile Action ValidateDuoWebResponse: Duo authentication succeeded for 'user'
DEBUG [net.shibboleth.idp.authn.AbstractValidationAction:354] - Profile Action ValidateDuoWebResponse: Adding custom Principal(s) defined on underlying flow descriptor
DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:198] - Profile Action TransitionMultiFactorAuthentication: Preserving authentication result from 'authn/Duo' flow
DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:215] - Profile Action TransitionMultiFactorAuthentication: Applying MFA transition rule to exit state 'authn/Duo'
DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:232] - Profile Action TransitionMultiFactorAuthentication: MFA flow completing with event 'proceed'
DEBUG [net.shibboleth.idp.authn.impl.FinalizeMultiFactorAuthentication:193] - Profile Action FinalizeMultiFactorAuthentication: MFA complete, producing merged result
DEBUG [net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext:79] - Profile Action PopulateSubjectCanonicalizationContext: Installing 2 canonicalization flows into SubjectCanonicalizationContext
DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] - Profile Action SelectSubjectCanonicalizationFlow: Checking canonicalization flow c14n/x500 for applicability...
DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:106] - Profile Action SelectSubjectCanonicalizationFlow: Canonicalization flow c14n/x500 was not applicable to this request
DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] - Profile Action SelectSubjectCanonicalizationFlow: Checking canonicalization flow c14n/simple for applicability...
DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:106] - Profile Action SelectSubjectCanonicalizationFlow: Canonicalization flow c14n/simple was not applicable to this request
ERROR [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:78] - Profile Action SelectSubjectCanonicalizationFlow: No potential flows left to choose from, canonicalization will fail
INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:138] - Profile Action SelectAuthenticationFlow: Moving incomplete flow authn/MFA to intermediate set
DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:395] - Profile Action SelectAuthenticationFlow: Specific principals requested with 'exact' operator: [AuthnContextClassRefPrincipal{authnContextClassRef=https://refeds.org/profile/mfa}]
DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:507] - Profile Action SelectAuthenticationFlow: Checking for an inactive flow or active result compatible with operator 'exact' and principal 'https://refeds.org/profile/mfa'
DEBUG [net.shibboleth.idp.authn.principal.PrincipalEvalPredicateFactoryRegistry:82] - Registry located predicate factory of type 'net.shibboleth.idp.authn.principal.impl.ExactPrincipalEvalPredicateFactory' for principal type 'class net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal' and operator 'exact'
INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:539] - Profile Action SelectAuthenticationFlow: None of the potential authentication flows can satisfy the request
WARN [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event occurred while processing the request: RequestUnsupported
DEBUG [org.opensaml.saml.common.profile.logic.DefaultLocalErrorPredicate:173] - Error event RequestUnsupported will be handled with response


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210413/ef680846/attachment.htm>