ECP on an idp configured for Azure Proxy (+MFA)

[Jeffrey Williams]

On Mon, Mar 28, 2022 at 2:28 PM Wessel, Keith <kwessel at illinois.edu> wrote:

> I’ll add to Scott’s reply and share my little cheating method. We’re
> currently proxying to ADFS with the SAML proxy. However, I have my MFA
> config set up with a checkFirstFactor script, similar to the
> checkSecondFactor script that shipped with the IdP. The sends the user to
> the SAML proxy flow for the first factor if it’s a browser. Ifit’s
> non-browser, it sends it down the old non-proxied flow of built-in password
> and Duo. This, of course, means two very different authentication
> mechanisms for browser vs. non-browser, but since cookies and sessions
> aren’t typically shared between browser and ECP (I can’t think of a case
> where they are), it works fine.
>

I had thought something similar, since we deployed the
"checkSecondFactor"-type flow before our current configuration.  However,
UNCG has transitioned from Duo to Azure for its MFA service, which is no
longer available as a standalone option.  We're also mandated by the state
to use MFA, so we couldn't direct them down a non-MFA flow.


>
> Keith
>
>
>
>
>
> *From:* users <users-bounces at shibboleth.net> *On Behalf Of *Jeffrey
> Williams via users
> *Sent:* Friday, March 25, 2022 3:29 PM
> *To:* Shib Users <users at shibboleth.net>
> *Cc:* Jeffrey Williams <jfwillia at uncg.edu>
> *Subject:* ECP on an idp configured for Azure Proxy (+MFA)
>
>
>
> We've been running our IDP's proxied to Azure for some time and have
> recently received our first request to have an integration with an ECP
> client.  At the moment, we have the single proxied flow to Azure(+Azure
> MFA).
>
>
>
> I was curious to know if anyone has handled ECP-type authn to an IDP that
> is proxying authn to Azure?
>
>
>
> --
>
> Jeffrey Williams
>
> Identity & Access Engineer
> Identity & Access Services
> https://its.uncg.edu
> <https://urldefense.com/v3/__https:/its.uncg.edu__;!!DZ3fjg!oFmJ0b0A58sf0GdkoHmtGDQVNfkRibr87M67QEXM3JjWwNY-JzgRXb33jByegG0v0g$>
>
>
>
> [image: Image removed by sender.]
>


-- 
Jeffrey Williams
Identity & Access Engineer
Identity & Access Services
https://its.uncg.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20220328/6d946897/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: ~WRD0001.jpg
Type: image/jpeg
Size: 823 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/users/attachments/20220328/6d946897/attachment.jpg>