Can we pass Duo's returned amr values on to clients?

[Zach Hanson-Hart]

Hi list!

Now that Duo returns amr values with the "second factor" authn, I'm interested in passing them along to client apps.  This brings three questions to mind:

  1.
How do I tell Shib to release the amr claim or not?
  2.
How do I tell Shib to include "pwd" and whatever Duo returned?
  3.
Can I create an IdP attribute from this data to expose to SAML clients?

I'm on Shib IdP v5.2.3 with net.shibboleth.idp.plugin.authn.duo.nimbus Version 2.3.0, and every authn is funneled through the MFA flow, with a script that chooses whether or not to continue on to Duo.

The background is that some SaaS apps are now "requiring" that "admins" use phishing resistant mfa.  Being the same login as for non-admins, the client can't request specific acr/amr values.  We force those apps to the refeds/mfa profile, so everyone must do password + duo for the SP.  We have two duo integrations, and one requires "phishing reistant mfa" in Duo's configuration, and we choose based on user attrs (groups from grouper via ldap) and the SP entity ID / client id.  We'd like to be able to pass the authentication methods actually performed on to clients who don't request the correct ones (or any like in SAML).

I suspect I'll have to go by way of Profiles, and an amrTranslationStrategy, but I'm not clear on the details.

Thanks!

Zach
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260917/d8c0060e/attachment.htm>