<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
David,
<div class=""><br class="">
</div>
<div class="">Some comments inline.</div>
<div class=""><br class="">
<div>
<blockquote type="cite" class="">
<div class="">On Jul 7, 2015, at 4:22 PM, IAM David Bantz <<a href="mailto:dabantz@alaska.edu" class="">dabantz@alaska.edu</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div dir="ltr" class="">I'm no longer seeing the IdP log error parsing incoming SAML. But I am seeing the following anomaly with MCB and the following requested authn context in the SAML request:
<div class=""><span class=""><br class="">
</span></div>
<div class=""><span class=""> <samlp:RequestedAuthnContext xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" </span>Comparison="exact">
<div class="">
<p class=""><span class=""> <saml:AuthnContextClassRef xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport<br class="">
</span> </saml:AuthnContextClassRef></p>
<p class=""> </samlp:RequestedAuthnContext></p>
<div class="">
<div class=""><br class="">
My account requires 2FA based on LDAP attribute; I successfully authN with password + Duo.</div>
<div class=""><br class="">
</div>
<div class="">Another user with no such LDAP attribute requiring 2FA successfully binds to LDAP, but the MCB rejects the authN as not meeting the requirement.</div>
</div>
</div>
</div>
</div>
</div>
</blockquote>
<div><br class="">
</div>
<div>One of the issues here is that the log snippet below shows the user as having no allowable context values. Saying no allowable values is not the same as saying any value is allowable. The MCB is going to take that zero item list and never find a match.</div>
<div><br class="">
</div>
<blockquote type="cite" class="">
<div class="">
<div dir="ltr" class="">
<div class=""><br class="">
</div>
<div class="">MCB log snippets for both transactions are at the end of this email.</div>
<div class=""><br class="">
</div>
<div class="">Presumably some part of the MCB configuration should be changed to allow method password to satisfy the requested context of PasswordProtectedTransport;
<br class="">
a pointer to what needs to change would be appreciated.</div>
<div class=""><br class="">
</div>
<div class="">Here's what I have in <span style="font-size:12.8000001907349px" class="">multi-context-broker.xml</span></div>
<div class="gmail_extra" style="font-size:12.8000001907349px">
<p class=""> <initialAuthContext requestedOnly="false"></p>
<p class=""> <context name="urn:oasis:names:tc:SAML:2.0:ac:classes:<span class="">PasswordProtectedTransport</span>" /></p>
<p class=""> </initialAuthContext></p>
<p class="">and this under authnContexts:</p>
<p class=""> <context name="urn:oasis:names:tc:SAML:2.0:ac:classes:<span class="">PasswordProtectedTransport</span>" method="<span class="">password</span>"></p>
<p class=""> <allowedContexts></p>
<p class=""> <context name="<a href="https://iam.alaska.edu/trac/wiki/mfa" target="_blank" class="">https://iam.alaska.edu/trac/wiki/mfa</a>" /></p>
<p class=""> </allowedContexts></p>
<div class=""><br class="webkit-block-placeholder">
</div>
<p class=""> </context></p>
</div>
</div>
</div>
</blockquote>
<div>So you need something like this to allow the “Password” context to be satisfied by the “PasswordProtectedTransport” context:</div>
<div><br class="">
</div>
<div><context name=“urn:oasis:names:tc:SAML:2.0:ac:classes:Password” method=“password”></div>
<div> <allowedContexts></div>
<div> <context name=“urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport” /></div>
<div> </allowedContexts></div>
<div></context></div>
<div><br class="">
</div>
<div><br class="">
</div>
<br class="">
<blockquote type="cite" class="">
<div class="">
<div dir="ltr" class="">
<div class="">Here are log snippets from the two transactions:</div>
<div class=""><br class="">
</div>
<div class="">
<p class="">Successful authN via LDAP; no directory attribute requiring 2FA;</p>
<p class="">then the MCB reports:</p>
<p class=""><span class="">11:40:10.888 - DEBUG [...MCBLoginServlet:217] - Found idms attribute: null</span></p>
<p class=""><span class="">11:40:10.888 - DEBUG [...MCBLoginServlet:219] - Found [0] values in attribute.</span></p>
</div>
</div>
</div>
</blockquote>
<div>Right here you’ve told the MCB that this user is not allowed to use any context value. You’ve got to supply something for them to be able to succeed.</div>
<div><br class="">
</div>
<blockquote type="cite" class="">
<div dir="ltr" class="">
<div class="">
<p class=""><span class="">corresponding login for dabantz (with 2FA required):</span></p>
11:37:29.918 - DEBUG [...MCBLoginServlet:217] - Found idms attribute: assurance<br class="">
<br class="">
11:37:29.918 - DEBUG [...MCBLoginServlet:219] - Found [1] values in attribute.<br class="">
</div>
</div>
</blockquote>
<div><br class="">
</div>
<div>And this one has a value, so they succeed.</div>
</div>
<div apple-content-edited="true" class=""><br class="">
</div>
<div apple-content-edited="true" class="">Paul</div>
<div apple-content-edited="true" class=""><br class="">
</div>
<div apple-content-edited="true" class="">-----<br class="">
Paul Hethmon<br class="">
Chief Software Architect<br class="">
<a href="mailto:paul.hethmon@clareitysecurity.com" class="">paul.hethmon@clareitysecurity.com</a><br class="">
<br class="">
</div>
<br class="">
</div>
</body>
</html>