SP Requiring/Requesting MFA (was Re: Customizing Second Factor Configuration in mfa-authn-config.xml)

[Ullfig, Roberto Alfredo]

OK I thought that might be the case, but then that brings me back to my first question. If I have only MFA enabled then every service provider goes through this MFA Transition Map, right? If I want to enable Duo for just a few SPs I asked if I should put that code here but then you said I should be using a relying party profile for each SP, but if MFA is the only one enabled how is that going to work?

---
Roberto Ullfig - rullfig at uic.edu
Systems Administrator
Enterprise Applications & Services | Technology Solutions
University of Illinois - Chicago
________________________________
From: users <users-bounces at shibboleth.net> on behalf of Cantor, Scott <cantor.2 at osu.edu>
Sent: Monday, April 26, 2021 4:10 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: SP Requiring/Requesting MFA (was Re: Customizing Second Factor Configuration in mfa-authn-config.xml)

On 4/26/21, 5:00 PM, "users on behalf of Ullfig, Roberto Alfredo" <users-bounces at shibboleth.net on behalf of rullfig at uic.edu> wrote:

>    Is this just for RemoteUser then? It's OK to have Password there? In this thread:

I'm not talking about what's in your MFA ruleset, I'm talking about the idp.authn.flows property. That's all I'm talking about.

You have RemoteUser|MFA. It should be MFA alone. That's all I'm saying.

The MFA feature can invoke any flows it wants to. They don't get enabled separately. The MFA flow is enabled so that the IdP will call it and the rest is part of the MFA configuration.

-- Scott


--
For Consortium Member technical support, see https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=04%7C01%7Crullfig%40uic.edu%7Ccc77cecf2ce8403a523708d908f7bb41%7Ce202cd477a564baa99e3e3b71a7c77dd%7C0%7C0%7C637550682363798524%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=vSBAf7pfMkQZadAnXoTz1trCYXAtqZN67yS3jCq9JqE%3D&reserved=0
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210427/4e352351/attachment.htm>