<div dir="ltr">That's an interesting hint David. The request received by my IdP has 2 contexts listed in the request:<div>
<p class="p1"><span class="s1"><?xml version="1.0" encoding="UTF-8"?><br><samlp:AuthnRequest xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol</span><span class="s1"> ...></span></p>
<p class="p1"><span class="s1"><saml:Issuer xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion"><a href="https://identity">https://identity</a>.</span><span class="s2"><a href="http://research.gov">research.gov</a></span><span class="s1">/sso/sp</saml:Issuer><br></span>...<br><samlp:RequestedAuthnContext Comparison="exact" xmlns:samlp="urn:oasis:names:tc:SAML:2.0:protocol"><br> <saml:AuthnContextClassRef xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:<b>ac:classes:unspecified</b></saml:AuthnContextClassRef><br> <saml:AuthnContextClassRef xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion">urn:oasis:names:tc:SAML:2.0:<b>ac:classes:PasswordProtectedTransport</b></saml:AuthnContextClassRef><br> </samlp:RequestedAuthnContext><br>...</p><p class="p1"><span class="s1">I'm returning for my own login attempt an indication of MCB/duo in AuthnContextClassRef:</span><br></p><p class="p1"><span class="s1">... <saml2:AuthnStatement ...><br></span> <saml2:AuthnContext><br> <saml2:AuthnContextClassRef><b><a href="https://iam.alaska.edu/trac/wiki/mfa">https://iam.alaska.edu/trac/wiki/mfa</a><</b>/saml2:AuthnContextClassRef><br> </saml2:AuthnContext>...</p><p class="p1"><span class="s1">and for non 2-factor user, I'm returning simply "Password" in AuthnContextClassRef:</span></p><p class="p1"><span class="s1"> ... <saml2:AuthnStatement ...><br></span> <saml2:SubjectLocality Address="137.229.40.130"/><br> <saml2:AuthnContext><br> <saml2:AuthnContextClassRef><b>urn:oasis:names:tc:SAML:2.0:ac:classes:Password</b></saml2:AuthnContextClassRef> </saml2:AuthnContext>...</p><p class="p1">I should be forcing the context to PPT? <br></p><p class="p1">How do I do that for an SP?</p><p class="p1">David Bantz</p><p class="p1"><br></p></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Aug 18, 2015 at 12:48 PM, David Langenberg <span dir="ltr"><<a href="mailto:davel@uchicago.edu" target="_blank">davel@uchicago.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">What authncontext are you sending to them? Research.gov has an odd requirement that you must send PPT even though they don't request it. <div><br></div><div>Ave<div><div class="h5"><span></span><br><br>On Tuesday, August 18, 2015, Kevin Foote <<a href="mailto:kpfoote@uoregon.edu" target="_blank">kpfoote@uoregon.edu</a>> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><br>
<br>
> On Aug 18, 2015, at 12:51 PM, IAM David Bantz <<a>dabantz@alaska.edu</a>> wrote:<br>
><br>
> We set up federated (via InC) access to NSF and <a href="http://research.gov" target="_blank">research.gov</a> quote a while ago. An email from an NSF contractor 5 Aug requested testing of "new authentication technology" from which I discovered our institution's federated login attmpts now fail with the sole information in the browser "Single Singn On failed"; for all I know this may have been in fail state some time prior to this request and whatever change was made at <a href="http://research.gov" target="_blank">research.gov</a>.<br>
><br>
> Are others experiencing any problems with Shibb-InC federated access to <a href="http://research.gov" target="_blank">research.gov</a> or is it just our IdP?<br>
><br>
> (I'm asking here because over 2 weeks since providing my logs to them showing outgoing SAML assertion, the only responses I've pried from NSF are "reboot your computer and try again" and "are your credentials registered with InCommon?”)<br>
<br>
Hi David,<br>
<br>
I can’t say that I’ve had as much trouble as you.<br>
I acted on the email that you referred to in your message and I got a similar “failed” message. I replied to the said address with the results and heard nothing - still nothing.<br>
However I tried a few days later and all worked.<br>
<br>
AFAIK it is still working as well, no complaints and a few general population logins for the service.<br>
<br>
--------<br>
thanks<br>
kevin.foote<br>
<br>
--<br>
To unsubscribe from this list send an email to <a>users-unsubscribe@shibboleth.net</a></blockquote></div></div></div><span class="HOEnZb"><font color="#888888"><br><br>-- <br><div dir="ltr"><div>David Langenberg<div>Identity & Access Management Architect</div><div>The University of Chicago</div></div></div><br>
</font></span><br>--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.net</a><br></blockquote></div><br></div>