forced authentication attribute not being used

[Matthew Slowe]

On 2022-03-11 04:03, Jeff McCullough wrote:
> We are using the  authn/External module in 4.1.4. I have the property 
> setting in authn.properties to allow forced Authentication:
> 
> idp.authn.External.forcedAuthenticationSupported = true
> 
> 
> but it doesn’t appear to use it. I see the following error in the logs:
> 
> DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByForcedAuthn:79] - 
> Profile Action FilterFlowsByForcedAuthn: Removing flow authn/External, 
> it does not support forced authentication
> 
> Any advice on how to troubleshoot? The documentation suggests this is 
> the way to turn on support for forced authentication.

Morning Jeff,

Might be way off base here but if you've upgraded from a previous 
incarnation of the IdP (not sure how far back off the top of my head) 
then those properties may not actually being used. (Did you have to 
create the property somewhere or did you update a pre-existing placeholder?)

If you have a <bean> in conf/authn/general-authn.xml with 
id="authn/External" then you could try adding this to it:

p:forcedAuthenticationSupported="true"

<bean id="authn/External" parent="shibboleth.AuthenticationFlow"
     p:nonBrowserSupported="false" />

becomes:

<bean id="authn/External" parent="shibboleth.AuthenticationFlow"
     p:forcedAuthenticationSupported="true"
     p:nonBrowserSupported="false" />

As I said, I may be way off base but worth mentioning :-)

See also the "Flow descriptor XML" section at 
https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631607/ExternalAuthnConfiguration#Reference

Hope that helps,
-- 
Matthew Slowe (GPG: 0x6BE0CF7D04600314)
Senior Technical Consultant and Support specialist, Jisc
Team: 0300 300 2212, option 2
Lumen House, Library Avenue, Harwell Oxford, Didcot, OX11 0SG
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4219 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/users/attachments/20220311/7523f0b2/attachment.p7s>