<div dir="ltr">I'm no longer seeing the IdP log error parsing incoming SAML. But I am seeing the following anomaly with MCB and the following requested authn context in the SAML request:<div><span class=""><br></span></div><div><span class=""> <samlp:RequestedAuthnContext xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol" </span>Comparison="exact"><div>
<p class=""><span class=""> <saml:AuthnContextClassRef xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport<br></span> </saml:AuthnContextClassRef></p><p class=""> </samlp:RequestedAuthnContext></p><div><div><br>My account requires 2FA based on LDAP attribute; I successfully authN with password + Duo.</div><div><br></div><div>Another user with no such LDAP attribute requiring 2FA successfully binds to LDAP, but the MCB rejects the authN as not meeting the requirement.</div></div></div></div><div><br></div><div>MCB log snippets for both transactions are at the end of this email.</div><div><br></div><div>Presumably some part of the MCB configuration should be changed to allow method password to satisfy the requested context of PasswordProtectedTransport; <br>a pointer to what needs to change would be appreciated.</div><div><br></div><div>Here's what I have in <span style="font-size:12.8000001907349px">multi-context-broker.xml</span></div><div class="gmail_extra" style="font-size:12.8000001907349px"><p> <initialAuthContext requestedOnly="false"></p><p> <context name="urn:oasis:names:tc:SAML:2.0:ac:classes:<span class="">PasswordProtectedTransport</span>" /></p><p> </initialAuthContext></p><p>and this under authnContexts:</p><p> <context name="urn:oasis:names:tc:SAML:2.0:ac:classes:<span class="">PasswordProtectedTransport</span>" method="<span class="">password</span>"></p><p> <allowedContexts></p><p> <context name="<a href="https://iam.alaska.edu/trac/wiki/mfa" target="_blank">https://iam.alaska.edu/trac/wiki/mfa</a>" /></p><p> </allowedContexts></p><p></p><p> </context></p></div><div><br></div><div>Here are log snippets from the two transactions:</div><div><br></div><div>
<p class="">Successful authN via LDAP; no directory attribute requiring 2FA;</p>
<p class="">then the MCB reports:</p>
<p class=""><span class="">11:40:10.888 - DEBUG [...MCBLoginServlet:217] - Found idms attribute: null</span></p>
<p class=""><span class="">11:40:10.888 - DEBUG [...MCBLoginServlet:219] - Found [0] values in attribute.</span></p>
<p class=""><span class="">11:40:10.889 - DEBUG [...MCBLoginServlet:227] - User authenticated with method [password]</span></p>
<p class=""><span class="">11:40:10.889 - TRACE [...MCBConfiguration:316] - mtc = [password]</span></p>
<p class=""><span class="">11:40:10.889 - TRACE [...MCBLoginServlet:234] - Used context = [urn:oasis:names:tc:SAML:2.0:ac:classes:Password]</span></p>
<p class=""><span class="">11:40:10.889 - TRACE [...MCBLoginServlet:234] - Used context = [urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport]</span></p>
<p class=""><span class="">11:40:10.889 - TRACE [...MCBConfiguration:340] - Looking for value [urn:oasis:names:tc:SAML:2.0:ac:classes:Password] in list.</span></p>
<p class=""><span class="">11:40:10.889 - TRACE [...MCBConfiguration:340] - Looking for value [urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport] in list.</span></p>
<p class=""><span class="">11:40:10.889 - DEBUG [...MCBLoginServlet:257] - Used context listed in valid contexts = [false]</span></p>
<p class=""><span class="">11:40:10.889 - DEBUG [...MCBLoginServlet:261] - User [ssonwalkar] used a context NOT on the potential context list. They must re-authenticate with a valid context.</span></p>
<p class=""><span class="">11:40:10.890 - TRACE [...MCBConfiguration:366] - Container context: [urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport]</span></p>
<p class=""><span class="">11:40:10.890 - TRACE [...MCBConfiguration:381] - Looking for context [urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport] to be satisfied by a higher level context.</span></p>
<p class=""><span class="">11:40:10.890 - TRACE [...MCBConfiguration:413] - Adding context of [urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport]</span></p>
<p class=""><span class="">11:40:10.890 - TRACE [...MCBConfiguration:500] - Adding context of [<a href="https://iam.alaska.edu/trac/wiki/mfa">https://iam.alaska.edu/trac/wiki/mfa</a>]</span></p>
<p class=""><span class="">11:40:10.890 - TRACE [...MCBConfiguration:433] - containerWithChildren [urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport]</span></p>
<p class=""><span class="">11:40:10.890 - TRACE [...MCBConfiguration:433] - containerWithChildren [<a href="https://iam.alaska.edu/trac/wiki/mfa">https://iam.alaska.edu/trac/wiki/mfa</a>]</span></p>
<p class=""><span class="">11:40:10.890 - TRACE [...MCBConfiguration:398] - Returning ordered list with [0] elements.</span></p>
<p class=""><span class="">11:40:10.890 - DEBUG [...MCBLoginServlet:544] - Found [0] allowable contexts to choose from.</span></p>
<p class=""><span class="">11:40:10.890 - </span><span class="">WARN</span><span class=""> [...MCBLoginServlet:573] - Unable to satisfy requested authentication context of [[urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport]]. </span></p>
<p class=""><span class=""> Returning SAML error to SP.</span></p>
<p class=""><span class="">11:40:10.891 - DEBUG [...MCBLoginServlet:156] - Authentication result = [false]</span></p><p class=""><span class="">corresponding login for dabantz (with 2FA required):</span></p>11:37:29.918 - DEBUG [...MCBLoginServlet:217] - Found idms attribute: assurance<br><br>11:37:29.918 - DEBUG [...MCBLoginServlet:219] - Found [1] values in attribute.<br><br>11:37:29.918 - DEBUG [...MCBLoginServlet:227] - User authenticated with method [password]<br><br>11:37:29.918 - TRACE [...MCBConfiguration:316] - mtc = [password]<br><br>11:37:29.918 - TRACE [...MCBLoginServlet:234] - Used context = [urn:oasis:names:tc:SAML:2.0:ac:classes:Password]<br><br>11:37:29.918 - TRACE [...MCBLoginServlet:234] - Used context = [urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport]<br><br>11:37:29.918 - TRACE [...MCBConfiguration:340] - Looking for value [urn:oasis:names:tc:SAML:2.0:ac:classes:Password] in list.<br><br>11:37:29.918 - TRACE [...MCBConfiguration:340] - Looking for value [urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport] in list.<br><br>11:37:29.918 - DEBUG [...MCBLoginServlet:257] - Used context listed in valid contexts = [false]<br><br>11:37:29.919 - DEBUG [...MCBLoginServlet:261] - User [dabantz] used a context NOT on the potential context list. They must re-authenticate with a valid context.<br><br>11:37:29.919 - TRACE [...MCBConfiguration:363] - Source context: [<a href="https://iam.alaska.edu/trac/wiki/mfa">https://iam.alaska.edu/trac/wiki/mfa</a>]<br><br>11:37:29.919 - TRACE [...MCBConfiguration:366] - Container context: [urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport]<br><br>11:37:29.919 - TRACE [...MCBConfiguration:381] - Looking for context [urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport] to be satisfied by a higher level context.<br><br>11:37:29.919 - TRACE [...MCBConfiguration:413] - Adding context of [urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport]<br><br>11:37:29.919 - TRACE [...MCBConfiguration:500] - Adding context of [<a href="https://iam.alaska.edu/trac/wiki/mfa">https://iam.alaska.edu/trac/wiki/mfa</a>]<br><br>11:37:29.919 - TRACE [...MCBConfiguration:433] - containerWithChildren [urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport]<br><br>11:37:29.919 - TRACE [...MCBConfiguration:433] - containerWithChildren [<a href="https://iam.alaska.edu/trac/wiki/mfa">https://iam.alaska.edu/trac/wiki/mfa</a>]<br><br>11:37:29.920 - TRACE [...MCBConfiguration:391] - Adding context [<a href="https://iam.alaska.edu/trac/wiki/mfa">https://iam.alaska.edu/trac/wiki/mfa</a>] to ordered list.<br><br>11:37:29.920 - TRACE [...MCBConfiguration:398] - Returning ordered list with [1] elements.<br><br>11:37:29.920 - DEBUG [...MCBLoginServlet:544] - Found [1] allowable contexts to choose from.<br><br>11:37:29.920 - TRACE [...MCBLoginServlet:552] - Adding method [Duo Two-Factor Login]<br><br>11:37:29.920 - DEBUG [...MCBLoginServlet:585] - Using submodule with bean name of [mcb.duo]<br><br>…<br><br>11:37:41.503 - DEBUG [...MCBLoginServlet:217] - Found idms attribute: assurance<br><br>11:37:41.503 - DEBUG [...MCBLoginServlet:219] - Found [1] values in attribute.<br><br>11:37:41.503 - DEBUG [...MCBLoginServlet:227] - User authenticated with method [duo]<br><br>11:37:41.503 - TRACE [...MCBConfiguration:316] - mtc = [duo]<br><br>11:37:41.503 - TRACE [...MCBLoginServlet:234] - Used context = [<a href="https://iam.alaska.edu/trac/wiki/mfa">https://iam.alaska.edu/trac/wiki/mfa</a>]<br><br>11:37:41.504 - TRACE [...MCBConfiguration:340] - Looking for value [<a href="https://iam.alaska.edu/trac/wiki/mfa">https://iam.alaska.edu/trac/wiki/mfa</a>] in list.<br><br>11:37:41.504 - TRACE [...MCBConfiguration:342] - Found value [<a href="https://iam.alaska.edu/trac/wiki/mfa">https://iam.alaska.edu/trac/wiki/mfa</a>] in list.<br><br>11:37:41.504 - DEBUG [...MCBLoginServlet:257] - Used context listed in valid contexts = [true]<br><br>11:37:41.504 - DEBUG [...MCBLoginServlet:266] - Used context for principal [dabantz] is on the potential allowed list.<br><br>11:37:41.504 - TRACE [...MCBConfiguration:413] - Adding context of [urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport]<br><br>11:37:41.504 - TRACE [...MCBConfiguration:500] - Adding context of [<a href="https://iam.alaska.edu/trac/wiki/mfa">https://iam.alaska.edu/trac/wiki/mfa</a>]<br><br>11:37:41.504 - TRACE [...MCBConfiguration:433] - containerWithChildren [urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport]<br><br>11:37:41.504 - TRACE [...MCBConfiguration:433] - containerWithChildren [<a href="https://iam.alaska.edu/trac/wiki/mfa">https://iam.alaska.edu/trac/wiki/mfa</a>]<br><br>11:37:41.504 - TRACE [...MCBConfiguration:340] - Looking for value [<a href="https://iam.alaska.edu/trac/wiki/mfa">https://iam.alaska.edu/trac/wiki/mfa</a>] in list.<br><br>11:37:41.505 - TRACE [...MCBConfiguration:342] - Found value [<a href="https://iam.alaska.edu/trac/wiki/mfa">https://iam.alaska.edu/trac/wiki/mfa</a>] in list.<br><br>11:37:41.505 - DEBUG [...MCBLoginServlet:271] - Used context listed in requested contexts = [true]<br><br>11:37:41.505 - DEBUG [...MCBLoginServlet:274] - Simple case met. The used context is in the requested list for principal [dabantz]<br><br>11:37:41.505 - TRACE [...MCBConfiguration:450] - Looking for context of [<a href="https://iam.alaska.edu/trac/wiki/mfa">https://iam.alaska.edu/trac/wiki/mfa</a>] that satisfies a requested.<br><br>11:37:41.505 - TRACE [...MCBConfiguration:483] - No match found, returning null.<br><br>11:37:41.505 - DEBUG [...MCBLoginServlet:156] - Authentication result = [true]</div><div><br></div><div><br></div></div>