ECP on an idp configured for Azure Proxy (+MFA)

[Wessel, Keith]

I’ll add to Scott’s reply and share my little cheating method. We’re currently proxying to ADFS with the SAML proxy. However, I have my MFA config set up with a checkFirstFactor script, similar to the checkSecondFactor script that shipped with the IdP. The sends the user to the SAML proxy flow for the first factor if it’s a browser. Ifit’s non-browser, it sends it down the old non-proxied flow of built-in password and Duo. This, of course, means two very different authentication mechanisms for browser vs. non-browser, but since cookies and sessions aren’t typically shared between browser and ECP (I can’t think of a case where they are), it works fine.

Keith


From: users <users-bounces at shibboleth.net> On Behalf Of Jeffrey Williams via users
Sent: Friday, March 25, 2022 3:29 PM
To: Shib Users <users at shibboleth.net>
Cc: Jeffrey Williams <jfwillia at uncg.edu>
Subject: ECP on an idp configured for Azure Proxy (+MFA)

We've been running our IDP's proxied to Azure for some time and have recently received our first request to have an integration with an ECP client.  At the moment, we have the single proxied flow to Azure(+Azure MFA).

I was curious to know if anyone has handled ECP-type authn to an IDP that is proxying authn to Azure?

--
Jeffrey Williams
Identity & Access Engineer
Identity & Access Services
https://its.uncg.edu<https://urldefense.com/v3/__https:/its.uncg.edu__;!!DZ3fjg!oFmJ0b0A58sf0GdkoHmtGDQVNfkRibr87M67QEXM3JjWwNY-JzgRXb33jByegG0v0g$>

[Image removed by sender.]
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220328/27adb0a4/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: ~WRD0001.jpg
Type: image/jpeg
Size: 823 bytes
Desc: ~WRD0001.jpg
URL: <http://shibboleth.net/pipermail/users/attachments/20220328/27adb0a4/attachment.jpg>