Antw: Problem with MFA flows for OIDC client (Zur Zeit abwesend)
Samsamoddin Rajaei
Samsamoddin.Rajaei at bsb-muenchen.de
Thu Dec 21 15:51:16 UTC 2023
Sehr geehrte Damen und Herren,
vielen Dank für Ihre E-Mail. Bis einschließlich 05.01.2024 bin ich leider nicht erreichbar. Bitte wenden Sie sich in dringenden Fällen an edv.hotline at bsb-muenchen.de+49-89-28638-2611.
Mit freundlichen Samsamoddin Rajaei
----
Samsamoddin RajaeiBayerische Staatsbibliothek - Informationstechnologie
Ludwigstr. 16, D-80539 München
Tel: + 49 89 28638-2997E-Mail: Samsamoddin.Ra
>>> Darren Boss via users <users at shibboleth.net> 21.12.23 16:50 >>>
I've followed the instructions on this page for configuring both relying-party.xml and authn.properties but I'm getting errors on authentication. The MFA flow is executing but I'm seeing this message in the Shibboleth logs (redacting some of the log information like ip addresses):
||globus-preview||||||||||TokenRequest|TokenErrorResponse|||||python-requests/2.31.0
INFO [Shibboleth-Audit.OIDC.Token:338] - x.x.x.x|2023-12-21T15:30:24.438429Z|2023-12-21T15:30:24.554005Z||globus-preview||||||||||TokenRequest|TokenErrorResponse|||||python-INFO [net.shibboleth.idp.plugin.authn.duo.impl.DuoOIDCAuthnController:144] - Starting Duo 2FA for client 'DIPXXXXX', user 'dboss', and unique request state '99a5c395608008e65f9b703523178a0a'
INFO [net.shibboleth.idp.plugin.authn.duo.impl.DuoOIDCAuthnController:214] - Finished Duo 2FA for client 'DIPXXXXX', user 'dboss', and unique request state '99a5c395608008e65f9b703523178a0a'
INFO [net.shibboleth.idp.plugin.authn.duo.impl.ValidateDuoTokenAuthenticationResult:186] - Profile Action ValidateDuoTokenAuthenticationResult: Duo 2FA authentication succeeded for 'dboss', using second-factor 'Roaming authenticator (2fa)'
INFO [net.shibboleth.idp.authn.impl.FinalizeAuthentication:196] - Profile Action FinalizeAuthentication: Principal dboss authenticated
INFO [net.shibboleth.idp.saml.session.impl.SAML2SPSessionCreationStrategy:127] - Creating BasicSPSession in the absence of necessary information
|dboss|globus-preview||https://alliancecan.ca/ac/classes/mfa-allow-unenrolled|2023-12-21T15:30:22.355766Z||DXX5|public|false|||AuthenticationRequest|AuthenticationSuccessResponse||||83816d6c25a4cc4b85487c65cecbb135893d24ce0bff49b6a60e43dbfa8966ec|Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/119.0
INFO [Shibboleth-Audit.OIDC.SSO:338] - 129.222.185.23|2023-12-21T15:29:34.124320Z|2023-12-21T15:30:23.705194Z|dboss|globus-preview||https://alliancecan.ca/ac/classes/mfa-allow-unenrolled|2023-12-21T15:30:22.355766Z||DXX5|public|false|||AuthenticationRequest|AuthenticationSuccessResponse||||83816d6c25a4cc4b85487c65cecbb135893d24ce0bff49b6a60e43dbfa8966ec|Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/119.0
INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:455] - Profile Action SelectAuthenticationFlow: None of the potential authentication flows can satisfy the request
WARN [org.opensaml.profile.action.impl.LogEvent:101] - A non-proceed event occurred while processing the request: RequestUnsupported
WARN [org.opensaml.profile.action.impl.LogEvent:101] - A non-proceed event occurred while processing the request: RequestUnsupported
||globus-preview||||||||||TokenRequest|TokenErrorResponse|||||python-requests/2.31.0
INFO [Shibboleth-Audit.OIDC.Token:338] - 34.192.171.137|2023-12-21T15:30:24.438429Z|2023-12-21T15:30:24.554005Z||globus-preview||||||||||TokenRequest|TokenErrorResponse|||||python-requests/2.31.0
In the globus preview environment I'm seeing:
Error processing OAuth2 request
Sorry, but we encountered a problem while servicing your request.
RequestUnsupported
This is the snippit from relying-party.xml:
<bean id="ForceMFA" parent="RelyingPartyByName">
<constructor-arg name="relyingPartyIds">
<list>
<value>globus-preview</value>
</list>
</constructor-arg>
<property name="profileConfigurations">
<list>
<bean parent="OIDC.SSO">
<property name="defaultAuthenticationMethods">
arent="shibboleth.OIDCAuthnContextClassReference"
c:classRef="https://alliancecan.ca/ac/classes/mfa-allow-unenrolled" />
</property>
</bean>
<ref bean="OIDC.UserInfo"/>
</list>
</property>
</bean>
and from authn.properties:
idp.authn.MFA.supportedPrincipals = \
saml2/https://refeds.org/profile/mfa, \
saml2/https://alliancecan.ca/ac/classes/mfa-allow-unenrolled, \
saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocol, \
saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport, \
saml2/urn:oasis:names:tc:SAML:2.0:ac:classes:Password, \
saml1/http://alliancecan.ca/ac/classes/mfa, \
saml1/urn:oasis:names:tc:SAML:1.0:am:password, \
oidc/https://refeds.org/profile/mfa, \
oidc/https://alliancecan.ca/ac/classes/mfa-allow-unenrolled
When I rely on the default:
<bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty">
<property name="profileConfigurations">
<list>
<bean parent="SAML2.SSO"
p:postAuthenticationFlows="#{ {'context-check', 'attribute-release'} }">
<property name="defaultAuthenticationMethods">
<bean parent="shibboleth.SAML2AuthnContextClassRef"
c:classRef="https://alliancecan.ca/ac/classes/mfa-allow-unenrolled" />
</property>
</bean>
<ref bean="SAML2.ECP" />
<ref bean="SAML2.Logout" />
<ref bean="SAML2.ArtifactResolution" />
<ref bean="Liberty.SSOS" />
<bean parent="OIDC.SSO" p:postAuthenticationFlows="attribute-release">
</bean>
<ref bean="OIDC.Keyset" />
<ref bean="OIDC.UserInfo" />
<ref bean="OAUTH2.Introspection" />
<ref bean="OAUTH2.Revocation" />
</list>
</property>
</bean>
I don't have any issues logging into Globus.
--
For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
More information about the users
mailing list