Research.gov MFA

[Zico]

Thanks, I'll check it out.


On Sat, 8 Mar, 2025 at 12:33 AM, Michael Grady <mgrady at unicon.net> wrote:

>
>
> On Mar 7, 2025, at 12:16 PM, Zico <mailzico at gmail.com> wrote:
>
> Thanks for the quick reply!  So, if I understand correctly, a relying
> party override is my only option to force MFA for Research.gov
> <http://research.gov/>, even though they don't explicitly request it?
> Could you point me to any documentation or examples on how to implement
> this override in Shibboleth IDP?
>
>
> You could apply a metadata filter to your InCommon metadata config, or you
> can add something similar to the following in your relying-party.xml file's
> overrides section, as you would for any other kind of override:
>
>         <bean parent="RelyingPartyByName" c:relyingPartyIds="#{{
>             'https://identity.research.gov/sso/sp',
>             'https://identity.acpt.research.gov/sso/sp'
>             }}" >
>             <property name="profileConfigurations">
>                 <list>
>                     <bean parent="SAML2.SSO" >
>   <property name="defaultAuthenticationMethods">
>       <bean parent="shibboleth.SAML2AuthnContextClassRef"
>  c:classRef="https://refeds.org/profile/mfa" />
>   </property>
>                     </bean>
>     <ref bean="SAML2.Logout" />
>                 </list>
>             </property>
>         </bean>
>
> --
> Michael A. Grady
> IAM Architect, Unicon, Inc.
>
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20250308/48199831/attachment.htm>