Azure MFA and Shibboleth Proxy

[Robert Bradley]

On 09/03/2021 00:09, Cantor, Scott wrote:
> On 3/8/21, 6:59 PM, "users on behalf of Cole Griggs"
> <users-bounces at shibboleth.net on behalf of csgriggs at unr.edu> wrote:
> 
>> Considering the recent KB on Using SAML Proxying in the Shibboleth
>> IdP to connect with Azure AD [1], does anyone have any guidance or
>> have found a good source document on how to leverage Azure MFA, and
>> brings those claims/attributes into the Shibboleth IdP, and return
>> them to other SP’s ?
> 
> There's no particularly elegant way to turn the fact that Azure is
> violating the standard by expressing authentication type using
> attributes and turn that into the proper form (AuthnContext). I added
> a better hook for that for 4.1.
> 

It does populate AuthnContext as well, but for MFA logins, the 
AuthnContext is just "multifactor".  The attributes may give you more 
information if MFA is used, but I've not created an attribute registry 
file for Azure AD attributes yet.

> Going the other way, I don't know how it decides to apply MFA but I
> imagine it's not compliant in that direction either.
> 

As far as I can tell, Azure AD supports exact match only, so there's no 
support for minimum or maximum authentication levels and logins that 
require those will fail.  More problematically, authentication fails 
outright if the SP requests PasswordProtectedTransport and the user is 
currently logged in via FIDO2 key ("X509, Multifactor" in Azure terms). 
  You don't get the option of re-authenticating to Azure AD and 
Shibboleth via the desired method instead.

In my experience, authnContextClassRef requirements are more bother than 
they're worth outside of specific internal uses.


-- 
Dr Robert Bradley
Identity and Access Management Team, IT Services, University of Oxford

-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <http://shibboleth.net/pipermail/users/attachments/20210309/49ec37d2/attachment.sig>