Ping MFA with Shibboleth IDP 5

[Dan McLaughlin]

I have a requirement to enforce the use of specific MFA methods,
ensuring we maintain an audit trail of the MFA used.

For example, in my SAML Request I'm sending...

 <saml2p:RequestedAuthnContext Comparison="exact">
  <saml2:AuthnContextClassRef
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken</saml2:AuthnContextClassRef>
  <saml2:AuthnContextClassRef
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:SmartcardPKI</saml2:AuthnContextClassRef>
  <saml2:AuthnContextClassRef
xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:HardwareToken</saml2:AuthnContextClassRef>
 </saml2p:RequestedAuthnContext>

However, PING defaults to setting AuthnContext to
urn:oasis:names:tc:SAML:1.0:am:unspecified if SAML_AUTHN_CTX is not
configured correctly in PING. See
https://docs.pingidentity.com/pingfederate/12.3/administrators_reference_guide/pf_special_attr_names_contracts.html#saml_authn_ctx

So I get back this in the SAML Response...

   <saml:AuthnContext>
    <saml:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified</saml:AuthnContextClassRef>
   </saml:AuthnContext>

I don't see any way to make MFA fail out of the box because they
didn't send back a valid AuthnContext, other than adding an
inlineScript to the MFA TransitionMap that tries to enforce it.

OR

Is the correct way to handle this to have the SP enforce MFA?

 https://shibboleth.atlassian.net/wiki/spaces/SP3/pages/2114781453/Requiring+Multi-Factor+Authentication

--

Thanks,

Dan

On Mon, Aug 25, 2025 at 1:39 PM Cantor, Scott <cantor.2 at osu.edu> wrote:
>
> > Maybe I'll document it, where do you think a good place to
> > put it
>
> The KB space in a HowTo article.
>
> The Duo examples already demonstrate the best way to pull a canonical name to pass into Duo from an earlier factor, it doesn't require Java code, just Javascript.
>
> -- Scott
>
>