SP Requiring/Requesting MFA (was Re: Customizing Second Factor Configuration in mfa-authn-config.xml)

[Ullfig, Roberto Alfredo]

OK, this SP is sending this:

    <samlp:RequestedAuthnContext>
        <saml:AuthnContextClassRef xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">https://refeds.org/profile/mfa</saml:AuthnContextClassRef>
        <saml:AuthnContextClassRef xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">http://uis.edu/duo</saml:AuthnContextClassRef>
        <saml:AuthnContextClassRef xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:Password</saml:AuthnContextClassRef>
        <saml:AuthnContextClassRef xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</saml:AuthnContextClassRef>
    </samlp:RequestedAuthnContext>

So our IDP is using the first one listed here https://refeds.org/profile/mfa if it's available? If it's not available it ends up using urn:oasis:names:tc:SAML:2.0:ac:classes:Password -  But there's nothing in this SP's metadata indicating this.

The problem here is that if we enable MFA, we can't determine which SPs are passing this authncontext so we don't know which applications will be impacted by our change - unless we enable debug mode for a period of time and check our logs.


---
Roberto Ullfig - rullfig at uic.edu
Systems Administrator
Enterprise Applications & Services | Technology Solutions
University of Illinois - Chicago
________________________________
From: users <users-bounces at shibboleth.net> on behalf of Cantor, Scott <cantor.2 at osu.edu>
Sent: Monday, April 26, 2021 10:32 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: SP Requiring/Requesting MFA (was Re: Customizing Second Factor Configuration in mfa-authn-config.xml)

On 4/26/21, 10:52 AM, "users on behalf of Ullfig, Roberto Alfredo" <users-bounces at shibboleth.net on behalf of rullfig at uic.edu> wrote:

>    I found that one of our service providers works with an IDP that doesn't support MFA - yet when I enable
> MFA support, logins to the SP execute the MFA flow. If the SP required it shouldn't it have failed before?

I don't undertand the question. I don't know anything about your MFA configuration either, but a configuration that bases a decision on whether the request requires a custom Principal that is associated with the second factor won't apply that factor unless the IdP sees something in the AuthnRequest or has a defaultAuthenticationMethods property active for that SP.

Whether the MFA flow itself always *runs* is a very different sort of question and has much more variability.

-- Scott


--
For Consortium Member technical support, see https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=04%7C01%7Crullfig%40uic.edu%7C2934b85cb3c247508acc08d908c88ed3%7Ce202cd477a564baa99e3e3b71a7c77dd%7C0%7C0%7C637550479758339143%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=7lZhgHlmJy355RUmvdl4bed8Rgwv35Zn3qVwMtA9lU8%3D&reserved=0
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210426/13d07a1b/attachment.htm>