SP Requiring/Requesting MFA (was Re: Customizing Second Factor Configuration in mfa-authn-config.xml)

[Ullfig, Roberto Alfredo]

Is this just for RemoteUser then? It's OK to have Password there? In this thread:

https://shibboleth.1660669.n2.nabble.com/MFA-Resources-td7646951.html

You said:

"You have to change that to "MFA", and configure the MFA feature to combine the Password and Duo methods in a particular way to get to the end result you're trying to achieve. The default rules and scripts in the mfa-authn-config file basically do this, but they do it by demonstrating IPAddress and Password instead of Password and Duo. It is a straight text replacement in many cases to get a basically working example of Password and Duo."

And if you look at the original it has:

        <entry key="">
            <bean parent="shibboleth.authn.MFA.Transition" p:nextFlow="authn/IPAddress" />
        </entry>

            <![CDATA[                nextFlow = "authn/Password";


so it seems that you are implying that this is valid:

       <entry key="">
            <bean parent="shibboleth.authn.MFA.Transition" p:nextFlow="authn/Password" />
        </entry>
        <entry key="authn/Password">
            <bean parent="shibboleth.authn.MFA.Transition" p:nextFlowStrategy-ref="checkSecondFactor" />
        </entry>

but this not:

       <entry key="">
            <bean parent="shibboleth.authn.MFA.Transition" p:nextFlow="authn/RemoteUser" />
        </entry>
        <entry key="authn/RemoteUser">
            <bean parent="shibboleth.authn.MFA.Transition" p:nextFlowStrategy-ref="checkSecondFactor" />
        </entry>


---
Roberto Ullfig - rullfig at uic.edu
Systems Administrator
Enterprise Applications & Services | Technology Solutions
University of Illinois - Chicago
________________________________
From: users <users-bounces at shibboleth.net> on behalf of Cantor, Scott <cantor.2 at osu.edu>
Sent: Monday, April 26, 2021 3:30 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: SP Requiring/Requesting MFA (was Re: Customizing Second Factor Configuration in mfa-authn-config.xml)

On 4/26/21, 3:55 PM, "users on behalf of Ullfig, Roberto Alfredo" <users-bounces at shibboleth.net on behalf of rullfig at uic.edu> wrote:

>    Sorry, I'm not following. This configuration works - I'm not seeing where it can be subverted or why it's
> wrong.

I can't explain that without trying to explain all of the internals. It has to do with how the results are tracked. At minimum it will result in extra round trips through the RemoteUser step because the cases where it runs alone will not be "reused" when the MFA flow routes to it.

In simple cases where the first factor flow is enabled in both places it's not going to have much more impact than limiting SSO (*). If a second factor flow were enabled also or instead, it would just outright break in some cases.

-- Scott

(*) Which may be practically invisible to users anyway if the RemoteUser method itself is already handling SSO for that factor, which is common. Using Password is a more obvious example because there will be unexpected prompts for the password.


--
For Consortium Member technical support, see https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=04%7C01%7Crullfig%40uic.edu%7Cceab3fcbd9a443d1c19c08d908f23a2d%7Ce202cd477a564baa99e3e3b71a7c77dd%7C0%7C0%7C637550658718916200%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=eyHtrylczaujrw3x325OjqyH%2FWDvLleMw%2BjFtNQ1bZM%3D&reserved=0
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210426/8df7fc7e/attachment-0001.htm>