Customizing Second Factor Configuration in mfa-authn-config.xml

[Ullfig, Roberto Alfredo]

Thanks, it all works now.

---
Roberto Ullfig - rullfig at uic.edu
Systems Administrator
Enterprise Applications & Services | Technology Solutions
University of Illinois - Chicago
________________________________
From: users <users-bounces at shibboleth.net> on behalf of Cantor, Scott <cantor.2 at osu.edu>
Sent: Thursday, April 22, 2021 2:13 PM
To: Shib Users <users at shibboleth.net>
Subject: RE: Customizing Second Factor Configuration in mfa-authn-config.xml

> So to enable MFA for just one SP (Shibboleth) I do something like this?

Mechanically yes, but not specifically, no. "MFA" is not a Principal, it's a login flow. Flows are associated with custom Principals, particularly in the case of SAML 2 of a certain type that represents AuthnContextClassRefs. Those class refs are the abstractions that define how authentication quality is measured and expressed.

Attaching the Principal(s) to flows via their supportedPrincipals property and then to overrides via their defaultAuthenticationMethods property is what connects them.

AC class refs are URIs, not just "MFA". e.g. the REFEDS MFA context value, whose value is not in front of me just this second.

-- Scott


--
For Consortium Member technical support, see https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=04%7C01%7Crullfig%40uic.edu%7C109ad8fdb2ff49e3e19608d905c2d1d1%7Ce202cd477a564baa99e3e3b71a7c77dd%7C0%7C0%7C637547156588624166%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=5j0As9aGh%2FH9Dbo9oCZtV0Q9Hsnlz48m68DpwuHBq4o%3D&reserved=0
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210422/0b87e5af/attachment.htm>