<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
Hi,
<div><br>
</div>
<div>I did similar configuration as described in <a href="https://wiki.shibboleth.net/confluence/pages/viewpage.action?pageId=20807829">https://wiki.shibboleth.net/confluence/pages/viewpage.action?pageId=20807829</a>. Our IDP use Remote User as primary log
in so I made some changes in the configuration. It works as expected if the AuthnContextClass was not sent in the AuthnRequest or AuthnContextClassRef specified in the AuthnRequest is the same as the resolved value of eduPersonAssurance. Otherwise it didn’t
work.</div>
<div><br>
</div>
<div>Case 1:</div>
<div><br>
</div>
<div>if remoteUser class ref is specified in AuthnContextClassRef of AuthnRequest, but user opt in in DUO. After primary authentication, IDP sent back error status</div>
<div>
<pre id="txt"><saml2p:Status>
<saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Requester">
<saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:NoAuthnContext" />
</saml2p:StatusCode>
<saml2p:StatusMessage>authn</saml2p:StatusMessage>
</saml2p:Status></pre>
<div>Right now I don’t care about user should be promoted for DUO or not in this case. But I don’t expect IDP sent back error status.</div>
<div><br>
</div>
<div>Case 2:</div>
<div>If duo class ref is specified in AuthnContextClassRef of AuthnRequest, but user doesn’t opt in in DUO. After primary authentication, user was prompted for DUO. Even though user finished DUO authentication, IDP still sent back error status.</div>
</div>
<div><br>
</div>
<div>
<pre id="txt"><saml2p:Status>
<saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Requester">
<saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:NoAuthnContext" />
</saml2p:StatusCode>
<saml2p:StatusMessage>authn</saml2p:StatusMessage>
</saml2p:Status></pre>
<div>In this case, I think DUO should be prompted no matter user opt in or not. But IDP shouldn’t send back error status after successful DUO login.</div>
</div>
<div><br>
</div>
<div>Here are all the steps I did:</div>
<div>Step1,2 exactly the same as the wiki page</div>
<div>Step 3: global.xml</div>
<div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> <bean id="authn/Duo" parent="shibboleth.AuthenticationFlow"</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> p:nonBrowserSupported="false" p:forcedAuthenticationSupported="%{duo.forcedAuthenticationSupported:true}"></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> <property name="supportedPrincipals"></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> <util:list></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> <bean parent="shibboleth.SAML2AuthnContextClassRef"</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> c:classRef="<a href="http://cornell.edu/duo">http://cornell.edu/duo</a>" /></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> <bean parent="shibboleth.SAML1AuthenticationMethod"</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> c:method="<a href="http://cornell.edu/duo">http://cornell.edu/duo</a>" /></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> </util:list></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> </property></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> </bean></div>
</div>
<div>Step 4</div>
<div>Step 5. attribute-resolver.xml</div>
<div>
<div><br>
</div>
<div>Value "<font face="Menlo"><span style="font-size: 11px;"><a href="http://cornell.edu/duo”">http://cornell.edu/duo”</a> is returned for eduPersonAssurance when user opt in DUO</span></font></div>
<div><font face="Menlo"><span style="font-size: 11px;">Otherwise ""urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified”</span></font></div>
</div>
<div><font face="Menlo"><span style="font-size: 11px;"><br>
</span></font></div>
<div>step 6: same</div>
<div>Step 7: authn-comparison.xml</div>
<div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"><bean id="shibboleth.BetterClassRefMatchFactory" parent="shibboleth.InexactMatchFactory"></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo; min-height: 13px;">
<br>
</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> <property name="matchingRules"></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> <util:map></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> <entry key="urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified"></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> <list></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> <value><a href="http://cornell.edu/duo</value>">http://cornell.edu/duo</value></a></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> </list></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> </entry></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> </util:map></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> </property></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo; min-height: 13px;">
<br>
</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> </bean></div>
</div>
<div><br>
</div>
<div>Step 8 <span style="font-family: Menlo; font-size: 11px;">context-check-intercept-config.xml</span><span style="font-family: Menlo; font-size: 11px;"> </span></div>
<div><font face="Menlo"><span style="font-size: 11px;"><br>
</span></font></div>
<div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"><bean id="shibboleth.context-check.Condition" parent="shibboleth.Conditions.AND"></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> <constructor-arg></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> <list></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> <bean class="net.shibboleth.idp.profile.logic.AuthnClassPredicate"</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> c:authnClassesToMatch-ref="authnClassesToMatch"</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> c:predicateToDelegate-ref="attributePredicate" /></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> </list></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> </constructor-arg></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> </bean></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo; min-height: 13px;">
<br>
</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> <util:set id="authnClassesToMatch"></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> <value><a href="http://cornell.edu/duo</value>">http://cornell.edu/duo</value></a></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> </util:set></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo; min-height: 13px;">
<br>
</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> <bean id="attributePredicate" class="net.shibboleth.idp.profile.logic.SimpleAttributePredicate"></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> <property name="attributeValueMap"></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> <map></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> <entry key="eduPersonAssurance"></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> <list></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> <value><a href="http://cornell.edu/duo</value>">http://cornell.edu/duo</value></a></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> </list></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> </entry></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> </map></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> </property></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;"> </bean></div>
</div>
<div><br>
</div>
<div>Anything wrong with the configuration?</div>
<div><br>
</div>
<div>Thanks,</div>
<div>Hong</div>
</body>
</html>