Getting IdP attributes from proxy IdP

[Christopher Bongaarts]

On 2/2/2024 7:02 AM, Cantor, Scott wrote:
>> If asked for a specific context, the IdP throws a NoAuthnContext error and
>> logs indicate that none of the authn flows matched.
> If it's running the flow you expect, then the problem is what you're populating in the result and since you're presumably using that hook you asked about to decide what to populate, obviously if that doesn't take into consideration what the SP asked for, it will fail.
>
> OTOH, you can't just tell it what it wants to hear. If you can't meet the requirement, then failure is the expected outcome.
>
> Using hooks to dynamically populate the Subject implies that one is not auto-populating anything based on any other configuration.

It's not running any flows; it can't find one that supports that 
AuthnContext.  I'm pretty sure that implies that my list of 
supportedPrincipals from authn.properties is either not being used or 
I've typoed something.  Maybe I have some legacy v3 or v2 config that is 
blocking it.  Requesting either the www.umn.edu class or the REFEDS 
class results in the same error (haven't tried PPT yet but don't really 
care about that case in the Real World, just for the sake of debugging).

idp.authn.SAML.supportedPrincipals = \
urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport, \
urn:oasis:names:tc:SAML:2.0:ac:classes:Password, \
https://www.umn.edu/shibboleth/classes/authncontext/duo, \
https://refeds.org/profile/mfa

2024-02-02 10:28:59,668 - 128.101.xx.yy - DEBUG 
[net.shibboleth.idp.profile.impl.SelectRelyingPartyConfiguration:136] - 
Profile Action SelectRelyingPartyConfiguration: Found relying party 
configuration shibboleth.DefaultRelyingParty for request
2024-02-02 10:28:59,740 - 128.101.xx.yy - DEBUG 
[net.shibboleth.idp.saml.saml2.profile.impl.ProcessRequestedAuthnContext:221] 
- Profile Action ProcessRequestedAuthnContext: RequestedPrincipalContext 
created with operator exact and 1 custom principal(s)
2024-02-02 10:28:59,744 - 128.101.xx.yy - DEBUG 
[net.shibboleth.idp.authn.impl.PopulateAuthenticationContext:215] - 
Profile Action PopulateAuthenticationContext: Installed 1 potential 
authentication flows into AuthenticationContext
2024-02-02 10:28:59,757 - 128.101.xx.yy - DEBUG 
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:401] - Profile 
Action SelectAuthenticationFlow: Specific principals requested with 
'exact' operator: 
[AuthnContextClassRefPrincipal{authnContextClassRef=https://refeds.org/profile/mfa}]
2024-02-02 10:28:59,757 - 128.101.xx.yy - DEBUG 
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:409] - Profile 
Action SelectAuthenticationFlow: No active results available, selecting 
an inactive flow
2024-02-02 10:28:59,757 - 128.101.xx.yy - DEBUG 
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:431] - Profile 
Action SelectAuthenticationFlow: Checking for inactive flow compatible 
with operator 'exact' and principal 'https://refeds.org/profile/mfa'
2024-02-02 10:28:59,757 - 128.101.xx.yy - DEBUG 
[net.shibboleth.idp.authn.principal.PrincipalEvalPredicateFactoryRegistry:126] 
- Registry located predicate factory of type 
'net.shibboleth.idp.authn.principal.impl.ExactPrincipalEvalPredicateFactory' 
for principal type 'class 
net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal' 
and operator 'exact'
2024-02-02 10:28:59,757 - 128.101.xx.yy - INFO 
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:455] - Profile 
Action SelectAuthenticationFlow: None of the potential authentication 
flows can satisfy the request
2024-02-02 10:28:59,757 - 128.101.xx.yy - DEBUG 
[org.springframework.webflow.execution.ActionExecutor:53] - Finished 
executing 
net.shibboleth.idp.authn.impl.SelectAuthenticationFlow at 19a0b241; result 
= RequestUnsupported

-- 
%%  Christopher A. Bongaarts   %%cab at umn.edu           %%
%%  OIT - Identity Management  %%http://umn.edu/~cab   %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240202/e4212161/attachment.htm>