Fun with proxying to AzureAD

[Matthew Slowe]

> On 8 Jun 2021, at 14:52, Jeffrey Williams <jfwillia at uncg.edu> wrote:
> 
>> Am I barking up the wrong tree or have you "done something" to the Azure IdP end to get it to emit this as an AuthnContextClassRef?
>  
> We didn't make any changes to Azure, but its AuthnContext behavior seems to go with returning the minimum requested level of authn to the SP, defaulting to password, at least where password is used in the MFA stack. 
> 
> So if your SP doesn't request a particular level of authn and your user does MFA, Azure still sends back a password AuthnContext.  If the SP requests MFA (http://schemas.microsoft.com/claims/multipleauthn), and the user successfully performs it, Azure will return http://schemas.microsoft.com/claims/multipleauthn.  You can then map it to the REFEDS equivalent to send back to the SP.

Ah, brilliant, thanks. I also needed to tell the Shibboleth IdP that it was allowed to support the REFEDS profile by updating conf/authn/general-authn.xml to add a "supportedPrincples" property to the SAML flow configuration:

diff --git a/conf/authn/general-authn.xml b/conf/authn/general-authn.xml
index 02a2a7f..89f5af3 100644
--- a/conf/authn/general-authn.xml
+++ b/conf/authn/general-authn.xml
@@ -82,7 +82,21 @@
             p:passiveAuthenticationSupported="true"
             p:forcedAuthenticationSupported="true"
             p:proxyScopingEnforced="true"
-            p:discoveryRequired="true" />
+            p:discoveryRequired="true">
+
+            <property name="supportedPrincipals">
+                <list>
+                    <bean parent="shibboleth.SAML2AuthnContextClassRef"
+                        c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" />
+                    <bean parent="shibboleth.SAML2AuthnContextClassRef"
+                        c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:Password" />
+                    <bean parent="shibboleth.SAML1AuthenticationMethod"
+                        c:method="urn:oasis:names:tc:SAML:1.0:am:password" />
+                    <bean parent="shibboleth.SAML2AuthnContextClassRef"
+                        c:classRef="https://refeds.org/profile/mfa" />
+                </list>
+            </property>
+        </bean>

         <bean id="authn/External" parent="shibboleth.AuthenticationFlow"
             p:nonBrowserSupported="false" />


… then it worked.

Thanks,
-- 
Matthew Slowe (GPG: 0x6BE0CF7D04600314)
Senior Technical Consultant and Support specialist - Trust & Identity, Jisc
Team: 0300 300 2212, option 2
Lumen House, Library Avenue, Harwell Oxford, Didcot, OX11 0SG