<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
The idea behind step 8 is to assist with the fact that Password => Silver for us. I don't believe step 8 is necessary in your case. As for your attribute-resolver, we don't ever return :unspecified from the resolver. The results for the default case are
always the PasswordProtectedTransport class. The IdP treats :unspecified very different than any other context class, so I'd try first fixing your resolver and seeing if that helps any.
<div class=""><br class="">
</div>
<div class="">Dave</div>
<div class=""><br class="">
<div>
<blockquote type="cite" class="">
<div class="">On Sep 9, 2015, at 11:32 AM, Hong Ye <<a href="mailto:hy93@cornell.edu" class="">hy93@cornell.edu</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
Hi,
<div class=""><br class="">
</div>
<div class="">I did similar configuration as described in <a href="https://wiki.shibboleth.net/confluence/pages/viewpage.action?pageId=20807829" class="">https://wiki.shibboleth.net/confluence/pages/viewpage.action?pageId=20807829</a>. Our IDP use Remote User
as primary log in so I made some changes in the configuration. It works as expected if the AuthnContextClass was not sent in the AuthnRequest or AuthnContextClassRef specified in the AuthnRequest is the same as the resolved value of eduPersonAssurance. Otherwise
it didn’t work.</div>
<div class=""><br class="">
</div>
<div class="">Case 1:</div>
<div class=""><br class="">
</div>
<div class="">if remoteUser class ref is specified in AuthnContextClassRef of AuthnRequest, but user opt in in DUO. After primary authentication, IDP sent back error status</div>
<div class="">
<pre id="txt" class=""><saml2p:Status>
<saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Requester">
<saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:NoAuthnContext" />
</saml2p:StatusCode>
<saml2p:StatusMessage>authn</saml2p:StatusMessage>
</saml2p:Status></pre>
<div class="">Right now I don’t care about user should be promoted for DUO or not in this case. But I don’t expect IDP sent back error status.</div>
<div class=""><br class="">
</div>
<div class="">Case 2:</div>
<div class="">If duo class ref is specified in AuthnContextClassRef of AuthnRequest, but user doesn’t opt in in DUO. After primary authentication, user was prompted for DUO. Even though user finished DUO authentication, IDP still sent back error status.</div>
</div>
<div class=""><br class="">
</div>
<div class="">
<pre id="txt" class=""><saml2p:Status>
<saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Requester">
<saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:NoAuthnContext" />
</saml2p:StatusCode>
<saml2p:StatusMessage>authn</saml2p:StatusMessage>
</saml2p:Status></pre>
<div class="">In this case, I think DUO should be prompted no matter user opt in or not. But IDP shouldn’t send back error status after successful DUO login.</div>
</div>
<div class=""><br class="">
</div>
<div class="">Here are all the steps I did:</div>
<div class="">Step1,2 exactly the same as the wiki page</div>
<div class="">Step 3: global.xml</div>
<div class="">
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> <bean id="authn/Duo" parent="shibboleth.AuthenticationFlow"</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> p:nonBrowserSupported="false" p:forcedAuthenticationSupported="%{duo.forcedAuthenticationSupported:true}"></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> <property name="supportedPrincipals"></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> <util:list></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> <bean parent="shibboleth.SAML2AuthnContextClassRef"</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> c:classRef="<a href="http://cornell.edu/duo" class="">http://cornell.edu/duo</a>" /></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> <bean parent="shibboleth.SAML1AuthenticationMethod"</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> c:method="<a href="http://cornell.edu/duo" class="">http://cornell.edu/duo</a>" /></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> </util:list></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> </property></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> </bean></div>
</div>
<div class="">Step 4</div>
<div class="">Step 5. attribute-resolver.xml</div>
<div class="">
<div class=""><br class="">
</div>
<div class="">Value "<font face="Menlo" class=""><span style="font-size: 11px;" class=""><a href="http://cornell.edu/duo%E2%80%9D" class="">http://cornell.edu/duo”</a> is returned for eduPersonAssurance when user opt in DUO</span></font></div>
<div class=""><font face="Menlo" class=""><span style="font-size: 11px;" class="">Otherwise ""urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified”</span></font></div>
</div>
<div class=""><font face="Menlo" class=""><span style="font-size: 11px;" class=""><br class="">
</span></font></div>
<div class="">step 6: same</div>
<div class="">Step 7: authn-comparison.xml</div>
<div class="">
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""><bean id="shibboleth.BetterClassRefMatchFactory" parent="shibboleth.InexactMatchFactory"></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo; min-height: 13px;" class="">
<br class="">
</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> <property name="matchingRules"></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> <util:map></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> <entry key="urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified"></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> <list></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> <value><a href="http://cornell.edu/duo%3C/value%3E" class="">http://cornell.edu/duo</value></a></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> </list></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> </entry></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> </util:map></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> </property></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo; min-height: 13px;" class="">
<br class="">
</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> </bean></div>
</div>
<div class=""><br class="">
</div>
<div class="">Step 8 <span style="font-family: Menlo; font-size: 11px;" class="">context-check-intercept-config.xml</span><span style="font-family: Menlo; font-size: 11px;" class=""> </span></div>
<div class=""><font face="Menlo" class=""><span style="font-size: 11px;" class=""><br class="">
</span></font></div>
<div class="">
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""><bean id="shibboleth.context-check.Condition" parent="shibboleth.Conditions.AND"></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> <constructor-arg></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> <list></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> <bean class="net.shibboleth.idp.profile.logic.AuthnClassPredicate"</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> c:authnClassesToMatch-ref="authnClassesToMatch"</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> c:predicateToDelegate-ref="attributePredicate" /></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> </list></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> </constructor-arg></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> </bean></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo; min-height: 13px;" class="">
<br class="">
</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> <util:set id="authnClassesToMatch"></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> <value><a href="http://cornell.edu/duo%3C/value%3E" class="">http://cornell.edu/duo</value></a></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> </util:set></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo; min-height: 13px;" class="">
<br class="">
</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> <bean id="attributePredicate" class="net.shibboleth.idp.profile.logic.SimpleAttributePredicate"></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> <property name="attributeValueMap"></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> <map></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> <entry key="eduPersonAssurance"></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> <list></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> <value><a href="http://cornell.edu/duo%3C/value%3E" class="">http://cornell.edu/duo</value></a></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> </list></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> </entry></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> </map></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> </property></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> </bean></div>
</div>
<div class=""><br class="">
</div>
<div class="">Anything wrong with the configuration?</div>
<div class=""><br class="">
</div>
<div class="">Thanks,</div>
<div class="">Hong</div>
</div>
-- <br class="">
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" class="">
users-unsubscribe@shibboleth.net</a></div>
</blockquote>
</div>
<br class="">
<div class="">
<div class="">--<br class="">
David Langenberg<br class="">
Identity & Access Management Architect<br class="">
The University of Chicago<br class="">
</div>
<div class=""><br class="">
</div>
<br class="Apple-interchange-newline">
</div>
<br class="">
</div>
</body>
</html>