Azure MFA and Shibboleth Proxy

[Cantor, Scott]

On 3/8/21, 6:59 PM, "users on behalf of Cole Griggs" <users-bounces at shibboleth.net on behalf of csgriggs at unr.edu> wrote:

>    Considering the recent KB on Using SAML Proxying in the Shibboleth IdP to connect with Azure AD [1], does
> anyone have any guidance or have found a good source document on how to leverage Azure MFA, and brings
> those claims/attributes into the Shibboleth IdP, and return them to other SP’s ?

There's no particularly elegant way to turn the fact that Azure is violating the standard by expressing authentication type using attributes and turn that into the proper form (AuthnContext). I added a better hook for that for 4.1.

Going the other way, I don't know how it decides to apply MFA but I imagine it's not compliant in that direction either.

Other than that piece, any data is made available to SPs the same as any data from any source is, by resolving it and then releasing it with a filter policy. That is universally true across any source of data. When proxying is involved that just happens to usually involve the Subject DataConnector and usually involves a different set of policy rules than is typical.

-- Scott