forced Authentication with authn/External

[Jeff Chapin]

Enabling forcedAuthenticationSupported for authn/External in IDP4
All,

We are stuck in a bit of a hard place. We are currently using
authn/External with an external CAS as our first factor in authn/MFA. We
are planning on replacing that with  authn/Password in the nearish future
(next month), but we have an SP that *needs* to go live earlier than that
(next week).

This SP requires that we allow forcedAuthentication -- it's the only one we
have run into that requires this, and they do not offer a QA environment
(they also will not tie their production to our QA environment). This
vendor does not seem to actually care if authentication is forced or not,
but the SP software they are using seems to default to it on, and they
cannot turn it off.

When this SP tries to connect, I get the following error in my logs:

Profile Action TransitionMultiFactorAuthentication: Targeted login flow
'authn/External' does not support forced re-authentication

I have looked through the documentation, and I have already tried setting
p:forceAuthn="true" in the relying-party.xml, and it seemed *not* to
resolve things. I presume that the error being generated comes earlier in
the login process than relying-party.xml does.

Is it as simple as adding idp.authn.external.forcedAuthenticationSupported
= true to the authn.properties to enable this?

I believe that while the authn/External will just check to see if the
current CAS cookie is valid and not prompt the user, we *will* be using Duo
with settings to "always prompt", so we will be honoring the spirit of
forcedAuthentication -- users will still have to verify their identity with
at least one factor before accessing the SP.

Please let me know if I am on the right track, or missing something.

Thanks,
Jeff

-- 

Jeff Chapin,

Panther eSports Adviser
Systems/Applications Administrator
ITS-IS, University of Northern Iowa
Phone: 319-273-3162 Email: Jeff.Chapin at uni.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240517/27d97056/attachment.htm>