MFA - Duo Configuration issue

[Srinivas Voruganti]

Dear Shibboleth Users,

Current at Rockefeller we are using Shibboleth IDP version 3.4. I am trying to enable MFA (Duo as second factor) for NIH requirements.

As a reference document I followed: Supporting the REFEDS MFA Profile - Shibboleth Knowledge Base - Shibboleth Wiki (atlassian.net)<https://urldefense.proofpoint.com/v2/url?u=https-3A__shibboleth.atlassian.net_wiki_spaces_KB_pages_1474297850_Supporting-2Bthe-2BREFEDS-2BMFA-2BProfile&d=DwMFAg&c=JeTkUgVztGMmhKYjxsy2rfoWYibK1YmxXez1G3oNStg&r=-CYQGhDCW_XVXWqNKPn5s07p1awyFSt0c0S-5qutrqc&m=Gyt05Sr06PPRAba170ENJxDDiU6dVkfJ-09G4f1pla0&s=k_3iPif_91EwUiGtE8W2LuBXxonmmhjx-nWUfVAA9kw&e=>, I am unable to get the Duo working, running into following error:


2021-07-12 13:07:03,552 - DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:?] - Profile Action TransitionMultiFactorAuthentication: Applying MFA transition rule to exit state 'authn/Password'

2021-07-12 13:07:03,568 - DEBUG [net.shibboleth.idp.authn.principal.PrincipalEvalPredicateFactoryRegistry:?] - Registry located predicate factory of type 'net.shibboleth.idp.authn.principal.impl.ExactPrincipalEvalPredicateFactory' for principal type 'class net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal' and operator 'exact'

2021-07-12 13:07:03,568 - DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:?] - Profile Action TransitionMultiFactorAuthentication: MFA flow transition after 'proceed' event to 'authn/Duo' flow

2021-07-12 13:07:03,568 - ERROR [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:290] - Profile Action TransitionMultiFactorAuthentication: Targeted login flow 'authn/Duo' does not support forced re-authentication

2021-07-12 13:07:03,572 - WARN [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event occurred while processing the request: RequestUnsupported

2021-07-12 13:07:03,583 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:?] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.messaging.handler.impl.BasicMessageHandlerChain' on OUTBOUND message context

2021-07-12 13:07:03,583 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:?] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.ResponseImpl'

2021-07-12 13:07:03,583 - DEBUG [net.shibboleth.idp.saml.profile.impl.SpringAwareMessageEncoderFactory:?] - Looking up message encoder based on binding URI: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST

2021-07-12 13:07:03,586 - DEBUG [PROTOCOL_MESSAGE:?] -

<?xml version="1.0" encoding="UTF-8"?><saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="https://federation.nih.gov/Shibboleth.sso/SAML2/POST" ID="_2374d70a65b269080befa94986619158" InResponseTo="_d7170118348da48a64c60f198474f750" IssueInstant="2021-07-12T17:07:03.579Z" Version="2.0">

    <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">https://rushib.rockefeller.edu/idp/shibboleth</saml2:Issuer<https://rushib.rockefeller.edu/idp/shibboleth%3c/saml2:Issuer>>

    <saml2p:Status>

        <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Requester">

            <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:NoAuthnContext"/>

        </saml2p:StatusCode>

        <saml2p:StatusMessage>An error occurred.</saml2p:StatusMessage>

    </saml2p:Status>

</saml2p:Response>



2021-07-12 13:07:03,586 - DEBUG [net.shibboleth.idp.profile.impl.RecordResponseComplete:?] - Profile Action RecordResponseComplete: Record response complete

2021-07-12 13:07:03,586 - INFO [Shibboleth-Audit.SSO:?] - 20210712T170703Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_d7170118348da48a64c60f198474f750|https://federation.nih.gov/FederationGateway|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://rushib.rockefeller.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_2374d70a65b269080befa94986619158||||||
My conf/authn/mfa-authn-config.xml

<util:map id="shibboleth.authn.MFA.TransitionMap">
<entry key="">
<bean parent="shibboleth.authn.MFA.Transition" p:nextFlow="authn/Password" />
</entry>

<entry key="authn/Password">
<bean parent="shibboleth.authn.MFA.Transition" p:nextFlowStrategy-ref="checkSecondFactor" />
</entry>

</util:map>

<bean id="checkSecondFactor" parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript">
<constructor-arg>
<value>
<![CDATA[
nextFlow = "authn/Duo";

authCtx = input.getSubcontext("net.shibboleth.idp.authn.context.AuthenticationContext");
mfaCtx = authCtx.getSubcontext("net.shibboleth.idp.authn.context.MultiFactorAuthenticationContext");
if (mfaCtx.isAcceptable())
{ nextFlow = null; }

nextFlow; // pass control to second factor or end with the first
]]>
</value>
</constructor-arg>
</bean>


Can someone help me what's causing the issue?

Any help is really appreciated.

Thank you,
Srinivas.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210713/5fd58da4/attachment.htm>