forced authentication attribute not being used

[Jeff McCullough]

Good morning,

Thank you for your suggestions. I stopped using the general-authn.xml when converting to 4.1.x from 4.0.1. The documentation seems clear that the forced authentication property is available. By default it is set to false, and can be set to true in the authn.properties file. Either the property is being ignored or there is somewhere else it is again being set to false.

Jeff

> On Mar 11, 2022, at 1:41 AM, Matthew Slowe via users <users at shibboleth.net> wrote:
> 
> On 2022-03-11 04:03, Jeff McCullough wrote:
>> We are using the  authn/External module in 4.1.4. I have the property setting in authn.properties to allow forced Authentication:
>> idp.authn.External.forcedAuthenticationSupported = true
>> but it doesn’t appear to use it. I see the following error in the logs:
>> DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByForcedAuthn:79] - Profile Action FilterFlowsByForcedAuthn: Removing flow authn/External, it does not support forced authentication
>> Any advice on how to troubleshoot? The documentation suggests this is the way to turn on support for forced authentication.
> 
> Morning Jeff,
> 
> Might be way off base here but if you've upgraded from a previous incarnation of the IdP (not sure how far back off the top of my head) then those properties may not actually being used. (Did you have to create the property somewhere or did you update a pre-existing placeholder?)
> 
> If you have a <bean> in conf/authn/general-authn.xml with id="authn/External" then you could try adding this to it:
> 
> p:forcedAuthenticationSupported="true"
> 
> <bean id="authn/External" parent="shibboleth.AuthenticationFlow"
>    p:nonBrowserSupported="false" />
> 
> becomes:
> 
> <bean id="authn/External" parent="shibboleth.AuthenticationFlow"
>    p:forcedAuthenticationSupported="true"
>    p:nonBrowserSupported="false" />
> 
> As I said, I may be way off base but worth mentioning :-)
> 
> See also the "Flow descriptor XML" section at https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631607/ExternalAuthnConfiguration#Reference
> 
> Hope that helps,
> -- 
> Matthew Slowe (GPG: 0x6BE0CF7D04600314)
> Senior Technical Consultant and Support specialist, Jisc
> Team: 0300 300 2212, option 2
> Lumen House, Library Avenue, Harwell Oxford, Didcot, OX11 0SG
> -- 
> For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net