Strange behavior in shibboleth regarding MFA

[Jeff Chapin]

Thanks, I will look into  AuthnContextClassRef  and
defaultAuthenticationMethods  and see if I can get this figured out.

Jeff

On Tue, Jun 18, 2024 at 8:56 AM Cantor, Scott <cantor.2 at osu.edu> wrote:

> > The issue is that Portal uses a Duo profile that allows user to
> > be remembered for a full day, and the Java application is
> > supposed to force the user to run Duo each time they log in.
>
> You need to use separate Duo integrations (which you did), but you also
> have to attach different custom AuthnContextClassRef custom Principals to
> the integration objects, and select them in a script on the basis of which
> one satisfies a given request.
>
> Then you need drive that by attaching requirements with the
> defaultAuthenticationMethods profile setting so that the selection of the
> integration to use for Duo will be based on what the service needs.
>
> There are examples of that in the multiple integrations section of the Duo
> docs.
>
> > I'm assuming I am missing a 'force auth' setting somewhere -
>
> ForceAuthn is meant to bypass SSO entirely, that's not what you're asking
> about.
>
> -- Scott
>
>
>

-- 

Jeff Chapin,

Panther eSports Adviser
Systems/Applications Administrator
ITS-IS, University of Northern Iowa
Phone: 319-273-3162 Email: Jeff.Chapin at uni.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240618/f716a48a/attachment.htm>