Enable MFA/DUO on per SP ?

[Mohamed Lrhazi]

Thank you!

I got it to work in the TransitionMap, like this, but still have a question!

    <bean id="checkSecondFactor" parent=
"shibboleth.ContextFunctions.Scripted"
        factory-method="inlineScript">
        <constructor-arg>
            <value>
            <![CDATA[
                DUO_SPs = Java.type("java.util.Arrays").asList("
https://gitlab.cua.edu");
                rpid =
profileContext.getSubcontext("net.shibboleth.idp.profile.context.RelyingPartyContext").getRelyingPartyId();
                logger =
Java.type("org.slf4j.LoggerFactory").getLogger("checkSecondFactor");
                logger.info('Checking SP: ' + rpid);
                if (DUO_SPs.contains(rpid)) {
                    nextFlow = "authn/DuoOIDC";
                } else {
                    nextFlow = null;
                }
                nextFlow;
            ]]>
            </value>
        </constructor-arg>
    </bean>


This enforces MFA for the SP, but only if the user did not login any ohter
SP before!

How do I require MFA even when user has a valid session already?

Thank you so much!
Mohamed!


On Wed, Mar 1, 2023 at 10:55 AM Christopher Bongaarts via users <
users at shibboleth.net> wrote:

> You may want to consult this page from the docs:
>
>
> https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631610/MultiFactorAuthnConfiguration
>
> The example "Conditional use of two factors, Flow1 and Flow2" may be
> useful for your use case; instead of a scripted checkSecondFactor bean,
> you should be able to compose some built-in beans (see
>
> https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631700/PredefinedBeans
> for the list), in particular shibboleth.Conditions.RelyingPartyId to
> check for particular SP entity IDs.
>
>
> On 3/1/2023 9:28 AM, Mohamed Lrhazi via users wrote:
> > Hello,
> >
> > I enabled MFA and DUO, following the plugin documentation, latest IdP
> > and plugin versions... and it worked... but it is enabled for all
> > SPs.... How can I enable it only for specific service providers?
> >
> > Thanks a lot,
> > Mohamed.
> >
>
> --
> %%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
> %%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
> %%  University of Minnesota    %%  +1 (612) 625-1809    %%
>
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230301/13aa6789/attachment.htm>