Research.gov MFA

[Michael Grady]

> On Mar 7, 2025, at 12:16 PM, Zico <mailzico at gmail.com> wrote:
> 
> Thanks for the quick reply!  So, if I understand correctly, a relying party override is my only option to force MFA for Research.gov <http://research.gov/>, even though they don't explicitly request it?  Could you point me to any documentation or examples on how to implement this override in Shibboleth IDP?

You could apply a metadata filter to your InCommon metadata config, or you can add something similar to the following in your relying-party.xml file's overrides section, as you would for any other kind of override:

        <bean parent="RelyingPartyByName" c:relyingPartyIds="#{{
            'https://identity.research.gov/sso/sp',
            'https://identity.acpt.research.gov/sso/sp'
            }}" >
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO" >
			  <property name="defaultAuthenticationMethods">
			      <bean parent="shibboleth.SAML2AuthnContextClassRef"
					 c:classRef="https://refeds.org/profile/mfa" />
			  </property>
                    </bean>
		    <ref bean="SAML2.Logout" />
                </list>
            </property>
        </bean>

--
Michael A. Grady
IAM Architect, Unicon, Inc.



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250307/52e62171/attachment.htm>