Force MFA for SP requesting PasswordProtectedTransport

[Katy Czar]

Hello,
I am running into an issue that others have had, but I have not been able to find a satisfactory answer.  A client wants to require Duo MFA for a SP, and we typically do that by adding a RelyingPartyOverride for the SP where we set the defaultAuthenticationMethods property to include our local MFA class, "http://idp.uvm.edu/ac/classes/mfa"<http://idp.uvm.edu/ac/classes/mfa%22>.  However this particular SP is sending urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport as the AuthnContextClass, which is bypassing the defaultAuthenticationMethods property.  From what I can gather, the SP is asking for PasswordProtectedTransport, the IDP is able to satisfy that requirement, so it succeeds with only a password and doesn’t bother to check the second factor.

Things I have tried:
- Specifying the MFA flow in relying-party.xml with p:authenticationFlows=“MFA”.  No change to behavior
- Added the p:disallowedFeatures-ref="SAML2.SSO.FEATURE_AUTHNCONTEXT” in relying-party.xml. Authentication flow ends with an error as expected. We don’t want the flow to end in error, we would like to override the SP request.
- Added a transition map to mfa-authn-config.xml for Password flows to try to force the checkSecondFactor script. No change in behavior.
<entry key="authn/Password”>
 <bean parent="shibboleth.authn.MFA.Transition" p:nextFlowStrategy-ref="checkSecondFactor" />
 </entry>
- Changed idp.authn.flows to only contain MFA.  No change in behavior.

I have asked the client to have the SP remove the AuthnContextClass, but they are hesitant to change anything on the SP side since they are close to go live.  Regardless, I would like to prevent service providers from being able to bypass MFA by specifying an AuthnContextClass.

Thank you in advance for any suggestions!

__________________________________
Katy Czar
Systems Architecture & Admin
University of Vermont
kczar at uvm.edu<mailto:kczar at uvm.edu>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20231025/c51bec3e/attachment.htm>