Enable MFA/DUO on per SP ?

[Brian Moon]

The key there is setting the following in idp.properties:

idp.authn.flows = MFA

This will force everything through the MFA flow and will allow the IdP to
use the active session.

Cheers!

Brian Moon
Senior System Administrator, Enterprise Systems
Santa Clara University


On Wed, Mar 1, 2023 at 9:52 AM Mohamed Lrhazi via users <
users at shibboleth.net> wrote:

> Thank you!
>
> I got it to work in the TransitionMap, like this, but still have a
> question!
>
>     <bean id="checkSecondFactor" parent=
> "shibboleth.ContextFunctions.Scripted"
>         factory-method="inlineScript">
>         <constructor-arg>
>             <value>
>             <![CDATA[
>                 DUO_SPs = Java.type("java.util.Arrays").asList("
> https://gitlab.cua.edu
> <https://urldefense.com/v3/__https://gitlab.cua.edu__;!!MLMg-p0Z!B0L6vzkoECyTuTa-UqQb0k2Ta3ol31K70kuTL1RXgFzEhyyuLIdwg6CvRH-l6_kZxCiDBwtoPsMJHbQ$>
> ");
>                 rpid =
> profileContext.getSubcontext("net.shibboleth.idp.profile.context.RelyingPartyContext").getRelyingPartyId();
>                 logger =
> Java.type("org.slf4j.LoggerFactory").getLogger("checkSecondFactor");
>                 logger.info
> <https://urldefense.com/v3/__http://logger.info__;!!MLMg-p0Z!B0L6vzkoECyTuTa-UqQb0k2Ta3ol31K70kuTL1RXgFzEhyyuLIdwg6CvRH-l6_kZxCiDBwto-SUBzLc$>('Checking
> SP: ' + rpid);
>                 if (DUO_SPs.contains(rpid)) {
>                     nextFlow = "authn/DuoOIDC";
>                 } else {
>                     nextFlow = null;
>                 }
>                 nextFlow;
>             ]]>
>             </value>
>         </constructor-arg>
>     </bean>
>
>
> This enforces MFA for the SP, but only if the user did not login any ohter
> SP before!
>
> How do I require MFA even when user has a valid session already?
>
> Thank you so much!
> Mohamed!
>
>
> On Wed, Mar 1, 2023 at 10:55 AM Christopher Bongaarts via users <
> users at shibboleth.net> wrote:
>
>> You may want to consult this page from the docs:
>>
>>
>> https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631610/MultiFactorAuthnConfiguration
>> <https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631610/MultiFactorAuthnConfiguration__;!!MLMg-p0Z!B0L6vzkoECyTuTa-UqQb0k2Ta3ol31K70kuTL1RXgFzEhyyuLIdwg6CvRH-l6_kZxCiDBwtoNXmBcB4$>
>>
>> The example "Conditional use of two factors, Flow1 and Flow2" may be
>> useful for your use case; instead of a scripted checkSecondFactor bean,
>> you should be able to compose some built-in beans (see
>>
>> https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631700/PredefinedBeans
>> <https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631700/PredefinedBeans__;!!MLMg-p0Z!B0L6vzkoECyTuTa-UqQb0k2Ta3ol31K70kuTL1RXgFzEhyyuLIdwg6CvRH-l6_kZxCiDBwto3hmlFgw$>
>> for the list), in particular shibboleth.Conditions.RelyingPartyId to
>> check for particular SP entity IDs.
>>
>>
>> On 3/1/2023 9:28 AM, Mohamed Lrhazi via users wrote:
>> > Hello,
>> >
>> > I enabled MFA and DUO, following the plugin documentation, latest IdP
>> > and plugin versions... and it worked... but it is enabled for all
>> > SPs.... How can I enable it only for specific service providers?
>> >
>> > Thanks a lot,
>> > Mohamed.
>> >
>>
>> --
>> %%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
>> %%  OIT - Identity Management  %%  http://umn.edu/~cab
>> <https://urldefense.com/v3/__http://umn.edu/*cab__;fg!!MLMg-p0Z!B0L6vzkoECyTuTa-UqQb0k2Ta3ol31K70kuTL1RXgFzEhyyuLIdwg6CvRH-l6_kZxCiDBwtorrVastk$>
>> %%
>> %%  University of Minnesota    %%  +1 (612) 625-1809    %%
>>
>> --
>> For Consortium Member technical support, see
>> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
>> <https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!MLMg-p0Z!B0L6vzkoECyTuTa-UqQb0k2Ta3ol31K70kuTL1RXgFzEhyyuLIdwg6CvRH-l6_kZxCiDBwto3-BpkbQ$>
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
> --
> For Consortium Member technical support, see
> https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!MLMg-p0Z!B0L6vzkoECyTuTa-UqQb0k2Ta3ol31K70kuTL1RXgFzEhyyuLIdwg6CvRH-l6_kZxCiDBwto3-BpkbQ$
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230301/122ace2d/attachment.htm>