forceAuthn, MFA, RemoteUser

[Joseph A Jerista]

Hello

I am faced with a SP integration "newSP" into Shibboleth IDP5 which I am
having difficulty addressing -

newSP has a forceAuthn requirement.  This comes into Shib IDP as follows in
the authnrequest post  --  ForceAuthn="true"

Nearly all of our SPs use the basic MFA flow on our IDP, currently
configured for flow authn/MFA which uses authn/RemoteUser as 1st check and
authn/duoOIDC as 2nd check and is a very basic mfa-authn-config.xml

The problem is that authn/RemoteUser doesn't support forceAuthn so this
(fully expected result) occurs:

- IDP selects flow MFA which "potentially" supports forceAuthn (based on
the specific authn flows defined within)
- However within MFA flow the RemoteUser flow is examined and determined to
not support forced re-authentication
     "ERROR
[net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication ...
TransitionMultiFactorAuthentication: Targeted login flow 'authn/RemoteUser'
does not support forced re-authentication"
- RequestUnsupported exception is thrown and flow terminated with Authn
failure
     "A non-proceed event occurred while processing the request:
RequestUnsupported"

The IDP5 docs recommend creating an External authn flow to handle a
forcedAuthn requirement.  The main point of this mail is to ask:  Could
there be another solution?  Writing a custom External Authn is a lot of
effort for us to support a single SP.  Docs also say we should not modify
RemoteUser OOB, which makes sense, and is also probably not the right
solution as we have other SPs that use RemoteUser as part of MFA and we do
not wish to enforce forceAuthn on the other SPs.

I have created a custom flows before (just not External) so I could in
theory write a new  "authn/mfaForcedAuthn" which has some customization but
it's unclear what I might add to the corresponding mfaForcedAuthn-authn.xml
to set/enforce forcedAuthn in such a scenario.

If the answer is "suck it up and write the External flow" I can accept that
but I want to first make sure there isn't a lower maintenance solution
first.

Thanks for any help or guidance,
Joe Jerista
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20241028/c393cdf4/attachment.htm>