Customizing Second Factor Configuration in mfa-authn-config.xml

[Ullfig, Roberto Alfredo]

Thanks. OK, I have MFA working for all SPs by doing this:

idp.authn.flows= MFA

and configuring the appropriate files in the authn directory.

So to enable MFA for just one SP (Shibboleth) I do something like this?

idp.authn.flows= RemoteUser|MFA

        <bean parent="RelyingPartyByName" c:relyingPartyIds="https://shibsp-1.uic.edu/shibboleth">
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO.MDDriven" p:defaultAuthenticationMethods="#{ {'MFA'} }" />
                </list>
            </property>
        </bean>

This doesn't work:

"Profile Action SelectAuthenticationFlow: None of the potential authentication flows can satisfy the request".

---
Roberto Ullfig - rullfig at uic.edu
Systems Administrator
Enterprise Applications & Services | Technology Solutions
University of Illinois - Chicago
________________________________
From: users <users-bounces at shibboleth.net> on behalf of Cantor, Scott <cantor.2 at osu.edu>
Sent: Thursday, April 22, 2021 1:08 PM
To: Shib Users <users at shibboleth.net>
Subject: RE: Customizing Second Factor Configuration in mfa-authn-config.xml

(Example in https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fdisplay%2FIDP4%2FSAML2SSOConfiguration&data=04%7C01%7Crullfig%40uic.edu%7C3a9ac11f179a4166bef208d905b9a4b9%7Ce202cd477a564baa99e3e3b71a7c77dd%7C0%7C0%7C637547117153627104%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=rpa8Es2rSha3z8JdIwYFrteLQ6Jbei3hZzBHdpN5aF4%3D&reserved=0, Authentication tab)

-- Scott

> -----Original Message-----
> From: Cantor, Scott
> Sent: Thursday, April 22, 2021 2:06 PM
> To: Shib Users <users at shibboleth.net>
> Subject: RE: Customizing Second Factor Configuration in mfa-authn-config.xml
>
> > We want to enable Duo for just a few SPs. I believe this needs to be
> > configured in mfa-authn-config.xml in this bean
>
> No. Doing that is handled by attaching supportedPrincipals to an override for
> the RP(s) or via metadata, and then using that to influence the isAcceptable()
> calls in the transition rules.
>
> -- Scott

--
For Consortium Member technical support, see https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=04%7C01%7Crullfig%40uic.edu%7C3a9ac11f179a4166bef208d905b9a4b9%7Ce202cd477a564baa99e3e3b71a7c77dd%7C0%7C0%7C637547117153637055%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=gOOk0OCGJ3%2FS2iW%2B%2B8kzv5k%2FncdP009vgw5rrDViEzE%3D&reserved=0
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210422/cd634849/attachment.htm>