DuoOIDC passwordless event handling question

Wed Mar 11 20:47:58 UTC 2026

Based on my reading of those logs, the exit status of the DuoOIDC plugin
appears to be "proceed", so the DuoOIDC plugin does not have issues with
the factor used.

If it should have rejected the Duo response, there would be some
configuration required of the DuoOIDC plugin (
idp.duo.oidc.passwordless.allowedFactors).

That said, the exit status of the DuoPlugin will only be based on the Duo
authentication.   If you wanted (or needed) to check some additional items
after that Authentication stage completes and before things are finalized,
you would need to define another step linked to the "proceed" event.

I'll defer to Scotts answer on whether it's better to remove the
requirement from the SP or try to deal with it on the IDP....

Steve.

On Wed, Mar 11, 2026 at 4:17 PM Mak, Steven <makst at upenn.edu> wrote:

> I can send more debug logs. I was hoping to keep the email "light" at
> first.
>
> The background to this error is that my DuoOIDC flow currently only
> supports refeds/mfa + TimeSyncToken authContext principals. We integrate
> with a fair amount of SPs that add RequestedAuthnContext of minimum
> PasswordProtectedTransport. In our testing when we complete a passwordless
> authentication our principals available in the MFA flow do not include PPT.
> Our IdP then returns an error response status of NoAuthnContext.
>
> Here are more logs:
>
> 2026-03-11 16:11:48,467 - DEBUG
> [net.shibboleth.idp.plugin.authn.duo.impl.PostValidatePasswordlessEvaluation:201]
> - Profile Action PostValidatePasswordlessEvaluation: Refreshing
> passwordless cookie for '<username redacted>' if set
> 2026-03-11 16:11:48,471 - DEBUG
> [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:196] -
> Profile Action TransitionMultiFactorAuthentication: Preserving
> authentication result from 'authn/DuoOIDC' flow
> 2026-03-11 16:11:48,472 - DEBUG
> [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:213] -
> Profile Action TransitionMultiFactorAuthentication: Applying MFA transition
> rule to exit state 'authn/DuoOIDC'
> 2026-03-11 16:11:48,472 - DEBUG
> [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:241] -
> Profile Action TransitionMultiFactorAuthentication: MFA flow completing
> with event 'proceed'
> 2026-03-11 16:11:48,474 - DEBUG
> [net.shibboleth.idp.authn.impl.FinalizeMultiFactorAuthentication:187] -
> Profile Action FinalizeMultiFactorAuthentication: MFA complete, producing
> merged result
> 2026-03-11 16:11:48,477 - DEBUG
> [net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext:118]
> - Profile Action PopulateSubjectCanonicalizationContext: Installing 13 c14n
> flows into SubjectCanonicalizationContext
> 2026-03-11 16:11:48,545 - DEBUG
> [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:91] -
> Profile Action SelectSubjectCanonicalizationFlow: Selecting c14n descriptor
> c14n/simple (Inline implementation)
> 2026-03-11 16:11:48,545 - DEBUG
> [net.shibboleth.idp.authn.AbstractSubjectCanonicalizer:172] -
> SubjectCanonicalizer c14n/simple: trimming whitespace of input string
> '<username redacted>'
> 2026-03-11 16:11:48,546 - DEBUG
> [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:95] -
> Profile Action SelectSubjectCanonicalizationFlow: Inline c14n
> implementation c14n/simple completed successfully
> 2026-03-11 16:11:48,550 - DEBUG
> [net.shibboleth.idp.session.impl.DetectIdentitySwitch:142] - Profile Action
> DetectIdentitySwitch: No previous session found, nothing to do
> 2026-03-11 16:11:48,552 - DEBUG
> [net.shibboleth.idp.authn.impl.FinalizeAuthentication:114] - Profile Action
> FinalizeAuthentication: Canonical principal name was established as
> '<username redacted>'
> 2026-03-11 16:11:48,553 - DEBUG
> [net.shibboleth.idp.authn.impl.FinalizeAuthentication:241] - Profile Action
> FinalizeAuthentication: Checking result for compatibility with operator
> 'minimum' and principal
> 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport'
> 2026-03-11 16:11:48,555 - DEBUG
> [net.shibboleth.idp.authn.principal.PrincipalEvalPredicateFactoryRegistry:112]
> - Registry located predicate factory of type
> 'net.shibboleth.idp.authn.principal.impl.ExactPrincipalEvalPredicateFactory'
> for principal type 'class
> net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal' and
> operator 'minimum'
> 2026-03-11 16:11:48,557 - WARN
> [net.shibboleth.idp.authn.impl.FinalizeAuthentication:168] - Profile Action
> FinalizeAuthentication: Authentication result for flow authn/MFA did not
> satisfy the request
> 2026-03-11 16:11:48,571 - WARN
> [org.opensaml.profile.action.impl.LogEvent:94] - A non-proceed event
> occurred while processing the request: RequestUnsupported
> 2026-03-11 16:11:48,679 - DEBUG
> [net.shibboleth.idp.profile.interceptor.impl.PopulateProfileInterceptorContext:138]
> - Profile Action PopulateProfileInterceptorContext: No outbound interceptor
> flows active for this request
> 2026-03-11 16:11:48,691 - DEBUG
> [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:180] -
> Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of
> type 'org.opensaml.messaging.handler.impl.BasicMessageHandlerChain' on
> OUTBOUND message context
> 2026-03-11 16:11:48,691 - DEBUG
> [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:197] -
> Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on
> message context containing a message of type
> 'org.opensaml.saml.saml2.core.impl.ResponseImpl'
> 2026-03-11 16:11:48,772 - DEBUG
> [net.shibboleth.idp.saml.profile.impl.SpringAwareMessageEncoderFactory:76]
> - Looking up message encoder based on binding URI:
> urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST
> 2026-03-11 16:11:48,789 - DEBUG
> [net.shibboleth.idp.profile.impl.RecordResponseComplete:86] - Profile
> Action RecordResponseComplete: Record response complete
> 2026-03-11 16:11:48,792 - INFO [Shibboleth-Audit.SSO:333] -
> 2026-03-11T20:11:48.792257086Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_3f500a769a367e7c2a50289bbfaf758c|RPID_Redacted|
> http://shibboleth.net/ns/profiles/saml2/sso/browser|IdP_redacted|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_2b6a9342392d2c1f31c73d837ea8a313||||||
>
>
>
>
> *From: *Steven Premeau <steven.premeau at maine.edu>
> *Date: *Wednesday, March 11, 2026 at 4:02 PM
> *To: *Shib Users <users at shibboleth.net>
> *Cc: *Mak, Steven <makst at upenn.edu>
> *Subject: *Re: DuoOIDC passwordless event handling question
>
> Steven -
>
>   I know that those examples worked when the Passwordless support was
> released, but it's difficult to debug with the partial configuration.
>
> The error you are reporting is occurring after the MFA flow has completed,
> do you have any (debug) logging that offers up status as the MFA is
> working?
>
> Of note, if the request is including a specific authentication type, it
> could be that everything is working as you expect, but the end result does
> not satisfy that requirement.....
>
> Steve.
>
>
>
>
> On Wed, Mar 11, 2026 at 3:20 PM Mak, Steven via users <
> users at shibboleth.net> wrote:
>
> Hello all,
>
> In the DuoOIDCPasswordless configuration page there is an example movie
> where the user is returned to a password prompt screen if the factors are
> deemed unacceptable. I've read over the "Event Handling" section of the
> document several times. I've configured my mfa-authn-config.xml file to
> watch for these events in the authn/DuoOIDC nextFlowStrategy Map, but my
> IdP only seems to stop trying once it hits a RequestUnsupported result,
> instead of proceeding to the script ref I provide.
>
> Does anyone have an example of how these event handlers are supposed to be
> wired up?
>
> Profile Action FinalizeAuthentication: Authentication result for flow
> authn/MFA did not satisfy the request
> A non-proceed event occurred while processing the request:
> RequestUnsupported
>
> Am I missing some documentation on how to transition to from this event to
> my script? My checkFirstFactor clears the duoContext and sends the user to
> authn/Password just like the documented example, but it doesn't work.
>
> Here's the nextFlowStrategyMap I have:
>
>         <entry key="authn/DuoOIDC">
>             <bean parent="shibboleth.authn.MFA.Transition">
>                 <property name="nextFlowStrategyMap">
>                     <map>
>                         <entry key="RequestUnsupported"
> value-ref="checkFirstFactor"/>
>                         <entry key="ReselectFlow"
> value-ref="checkFirstFactor"/>
>                         <entry key="IdentitySwitch"
> value-ref="checkFirstFactor"/>
>                         <entry key="InvalidCredentials"
> value-ref="checkFirstFactor"/>
>                     </map>
>                 </property>
>             </bean>
>         </entry>
>
>
>
> https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3360686194/DuoOIDCPasswordless
> <https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3360686194/DuoOIDCPasswordless__;!!IBzWLUs!QpCXkYfSLLe3ue4U_eCocX1_BbjCpe9f3E7QPWy5lLz7nK0In23ythodnpGdJ0SwX2JLFuw61Qejb49FYXnM6IPhHQ$>
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> <https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!IBzWLUs!QpCXkYfSLLe3ue4U_eCocX1_BbjCpe9f3E7QPWy5lLz7nK0In23ythodnpGdJ0SwX2JLFuw61Qejb49FYXnLUP-VEQ$>
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260311/2965955b/attachment.htm>