DuoOIDC passwordless event handling question

Wed Mar 11 20:17:42 UTC 2026

I can send more debug logs. I was hoping to keep the email "light" at first.

The background to this error is that my DuoOIDC flow currently only supports refeds/mfa + TimeSyncToken authContext principals. We integrate with a fair amount of SPs that add RequestedAuthnContext of minimum PasswordProtectedTransport. In our testing when we complete a passwordless authentication our principals available in the MFA flow do not include PPT. Our IdP then returns an error response status of NoAuthnContext.

Here are more logs:

2026-03-11 16:11:48,467 - DEBUG [net.shibboleth.idp.plugin.authn.duo.impl.PostValidatePasswordlessEvaluation:201] - Profile Action PostValidatePasswordlessEvaluation: Refreshing passwordless cookie for '<username redacted>' if set
2026-03-11 16:11:48,471 - DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:196] - Profile Action TransitionMultiFactorAuthentication: Preserving authentication result from 'authn/DuoOIDC' flow
2026-03-11 16:11:48,472 - DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:213] - Profile Action TransitionMultiFactorAuthentication: Applying MFA transition rule to exit state 'authn/DuoOIDC'
2026-03-11 16:11:48,472 - DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:241] - Profile Action TransitionMultiFactorAuthentication: MFA flow completing with event 'proceed'
2026-03-11 16:11:48,474 - DEBUG [net.shibboleth.idp.authn.impl.FinalizeMultiFactorAuthentication:187] - Profile Action FinalizeMultiFactorAuthentication: MFA complete, producing merged result
2026-03-11 16:11:48,477 - DEBUG [net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext:118] - Profile Action PopulateSubjectCanonicalizationContext: Installing 13 c14n flows into SubjectCanonicalizationContext
2026-03-11 16:11:48,545 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:91] - Profile Action SelectSubjectCanonicalizationFlow: Selecting c14n descriptor c14n/simple (Inline implementation)
2026-03-11 16:11:48,545 - DEBUG [net.shibboleth.idp.authn.AbstractSubjectCanonicalizer:172] - SubjectCanonicalizer c14n/simple: trimming whitespace of input string '<username redacted>'
2026-03-11 16:11:48,546 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:95] - Profile Action SelectSubjectCanonicalizationFlow: Inline c14n implementation c14n/simple completed successfully
2026-03-11 16:11:48,550 - DEBUG [net.shibboleth.idp.session.impl.DetectIdentitySwitch:142] - Profile Action DetectIdentitySwitch: No previous session found, nothing to do
2026-03-11 16:11:48,552 - DEBUG [net.shibboleth.idp.authn.impl.FinalizeAuthentication:114] - Profile Action FinalizeAuthentication: Canonical principal name was established as '<username redacted>'
2026-03-11 16:11:48,553 - DEBUG [net.shibboleth.idp.authn.impl.FinalizeAuthentication:241] - Profile Action FinalizeAuthentication: Checking result for compatibility with operator 'minimum' and principal 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport'
2026-03-11 16:11:48,555 - DEBUG [net.shibboleth.idp.authn.principal.PrincipalEvalPredicateFactoryRegistry:112] - Registry located predicate factory of type 'net.shibboleth.idp.authn.principal.impl.ExactPrincipalEvalPredicateFactory' for principal type 'class net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal' and operator 'minimum'
2026-03-11 16:11:48,557 - WARN [net.shibboleth.idp.authn.impl.FinalizeAuthentication:168] - Profile Action FinalizeAuthentication: Authentication result for flow authn/MFA did not satisfy the request
2026-03-11 16:11:48,571 - WARN [org.opensaml.profile.action.impl.LogEvent:94] - A non-proceed event occurred while processing the request: RequestUnsupported
2026-03-11 16:11:48,679 - DEBUG [net.shibboleth.idp.profile.interceptor.impl.PopulateProfileInterceptorContext:138] - Profile Action PopulateProfileInterceptorContext: No outbound interceptor flows active for this request
2026-03-11 16:11:48,691 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:180] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.messaging.handler.impl.BasicMessageHandlerChain' on OUTBOUND message context
2026-03-11 16:11:48,691 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:197] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.ResponseImpl'
2026-03-11 16:11:48,772 - DEBUG [net.shibboleth.idp.saml.profile.impl.SpringAwareMessageEncoderFactory:76] - Looking up message encoder based on binding URI: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
2026-03-11 16:11:48,789 - DEBUG [net.shibboleth.idp.profile.impl.RecordResponseComplete:86] - Profile Action RecordResponseComplete: Record response complete
2026-03-11 16:11:48,792 - INFO [Shibboleth-Audit.SSO:333] - 2026-03-11T20:11:48.792257086Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_3f500a769a367e7c2a50289bbfaf758c|RPID_Redacted|http://shibboleth.net/ns/profiles/saml2/sso/browser|IdP_redacted|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_2b6a9342392d2c1f31c73d837ea8a313||||||

From: Steven Premeau <steven.premeau at maine.edu>
Date: Wednesday, March 11, 2026 at 4:02 PM
To: Shib Users <users at shibboleth.net>
Cc: Mak, Steven <makst at upenn.edu>
Subject: Re: DuoOIDC passwordless event handling question

Steven -

  I know that those examples worked when the Passwordless support was released, but it's difficult to debug with the partial configuration.

The error you are reporting is occurring after the MFA flow has completed, do you have any (debug) logging that offers up status as the MFA is working?

Of note, if the request is including a specific authentication type, it could be that everything is working as you expect, but the end result does not satisfy that requirement.....

Steve.

On Wed, Mar 11, 2026 at 3:20 PM Mak, Steven via users <users at shibboleth.net<mailto:users at shibboleth.net>> wrote:
Hello all,

In the DuoOIDCPasswordless configuration page there is an example movie where the user is returned to a password prompt screen if the factors are deemed unacceptable. I've read over the "Event Handling" section of the document several times. I've configured my mfa-authn-config.xml file to watch for these events in the authn/DuoOIDC nextFlowStrategy Map, but my IdP only seems to stop trying once it hits a RequestUnsupported result, instead of proceeding to the script ref I provide.

Does anyone have an example of how these event handlers are supposed to be wired up?

Profile Action FinalizeAuthentication: Authentication result for flow authn/MFA did not satisfy the request
A non-proceed event occurred while processing the request: RequestUnsupported

Am I missing some documentation on how to transition to from this event to my script? My checkFirstFactor clears the duoContext and sends the user to authn/Password just like the documented example, but it doesn't work.

Here's the nextFlowStrategyMap I have:

        <entry key="authn/DuoOIDC">
            <bean parent="shibboleth.authn.MFA.Transition">
                <property name="nextFlowStrategyMap">
                    <map>
                        <entry key="RequestUnsupported" value-ref="checkFirstFactor"/>
                        <entry key="ReselectFlow" value-ref="checkFirstFactor"/>
                        <entry key="IdentitySwitch" value-ref="checkFirstFactor"/>
                        <entry key="InvalidCredentials" value-ref="checkFirstFactor"/>
                    </map>
                </property>
            </bean>
        </entry>

https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3360686194/DuoOIDCPasswordless<https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3360686194/DuoOIDCPasswordless__;!!IBzWLUs!QpCXkYfSLLe3ue4U_eCocX1_BbjCpe9f3E7QPWy5lLz7nK0In23ythodnpGdJ0SwX2JLFuw61Qejb49FYXnM6IPhHQ$>
--
For Consortium Member technical support, see https://shibboleth.atlassian.net/wiki/x/ZYEpPw<https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!IBzWLUs!QpCXkYfSLLe3ue4U_eCocX1_BbjCpe9f3E7QPWy5lLz7nK0In23ythodnpGdJ0SwX2JLFuw61Qejb49FYXnLUP-VEQ$>
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260311/dad0a0ee/attachment.htm>