<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri","sans-serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:windowtext;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F497D">I have been struggling to get MFA-Duo working for the past couple weeks, and I’d appreciate any assistance in pointing out where I should be looking to make changes. <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">The IDP idp-process.log file shows that the attribute assurance (idp.authn.resolveAttribute = assurance) has 4 values:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">2015-10-12 13:09:23,723 - DEBUG [net.shibboleth.idp.attribute.resolver.AbstractAttributeDefinition:247] - Attribute Definition 'assurance': produced an attribute with the following values [StringAttributeValue{value=urn:oasis:names:tc:SAML:2.0:ac:classes:Password},
StringAttributeValue{value=http://id.incommon.org/assurance/bronze}, StringAttributeValue{value=http://id.incommon.org/assurance/silver}, StringAttributeValue{value=http://uis.edu/duo}]<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">However, the Potential authentication flows left after filtering only retain authn/Password and NOT authn/Duo:
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">2015-10-12 13:09:23,727 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByAttribute:134] - Profile Action FilterFlowsByAttribute: Retaining flow authn/Password, matched custom Principal urn:oasis:names:tc:SAML:2.0:ac:classes:Password<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">2015-10-12 13:09:23,728 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByAttribute:146] - Profile Action FilterFlowsByAttribute: Potential authentication flows left after filtering: {authn/Password=AuthenticationFlowDescriptor{flowId=authn/Password,
supportsPassive=true, supportsForcedAuthentication=true, lifetime=3600000, inactivityTimeout=1800000}}<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Where should I be looking to figure out why authn/Duo is not being considered a potential authentication flow? Is it in the global.xml bean definition or in the context-check-intercept-config.xml, or elsewhere?
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D">Any help would be appreciated!<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> users [mailto:users-bounces@shibboleth.net]
<b>On Behalf Of </b>Llosa, Tulio C<br>
<b>Sent:</b> Wednesday, September 30, 2015 1:56 PM<br>
<b>To:</b> users@shibboleth.net<br>
<b>Subject:</b> IDP 3 Duo + Username/Password with user-opt-in forcing Duo<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Hello,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">I followed the document Replicating Multi-Context Broker Functionality (Duo + Username/Password with user-opt-in forcing Duo):
<a href="https://wiki.shibboleth.net/confluence/pages/viewpage.action?pageId=20807829">
https://wiki.shibboleth.net/confluence/pages/viewpage.action?pageId=20807829</a> <o:p>
</o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">My problem is that I can't get the Duo Security service page to come up as a secondary authentication.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The SP configured for two-factor authentication shibboleth2.xml has:
<o:p></o:p></p>
<p class="MsoNormal">authnContextClassRef="<a href="http://uis.edu/duo">http://uis.edu/duo</a>"
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The error I get on the browser after authenticating with username/password is:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Error from identity provider:<o:p></o:p></p>
<p class="MsoNormal"> Status: urn:oasis:names:tc:SAML:2.0:status:Requester<o:p></o:p></p>
<p class="MsoNormal"> Sub-Status: urn:oasis:names:tc:SAML:2.0:status:NoAuthnContext<o:p></o:p></p>
<p class="MsoNormal"> Message: An error occurred.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">All other SP's (without the Duo authnContextClassRef) authenticate successfully using username/password.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">My configuration is as follows:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">On the IDP side:<o:p></o:p></p>
<p class="MsoNormal">Steps 1,2: Same as the wiki page above<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Step 3: $IDP_HOME/conf/global.xml<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><bean id="authn/Duo" parent="shibboleth.AuthenticationFlow"<o:p></o:p></p>
<p class="MsoNormal"> p:nonBrowserSupported="false" p:forcedAuthenticationSupported="%{duo.forcedAuthenticationSupported:true}"><o:p></o:p></p>
<p class="MsoNormal"> <property name="supportedPrincipals"><o:p></o:p></p>
<p class="MsoNormal"> <util:list><o:p></o:p></p>
<p class="MsoNormal"> <bean parent="shibboleth.SAML2AuthnContextClassRef"<o:p></o:p></p>
<p class="MsoNormal"> c:classRef="<a href="http://uis.edu/duo">http://uis.edu/duo</a>" /><o:p></o:p></p>
<p class="MsoNormal"> <bean parent="shibboleth.SAML1AuthenticationMethod"<o:p></o:p></p>
<p class="MsoNormal"> c:method="<a href="http://uis.edu/duo">http://uis.edu/duo</a>" /><o:p></o:p></p>
<p class="MsoNormal"> </util:list><o:p></o:p></p>
<p class="MsoNormal"> </property><o:p></o:p></p>
<p class="MsoNormal"> </bean><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Step 4: Completed. shib-extensions.jar built and copied to $IDP_HOME/edit-webapp/WEB-INF/lib/
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Step 5: $IDP_HOME/conf/attribute-resolver.xml<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Static attribute "assurance" with values "urn:oasis:names:tc:SAML:2.0:ac:classes:Password" and "<a href="http://uis.edu/duo">http://uis.edu/duo</a>" for everyone for now. Eventually it will be a scripted attribute that sets the password
context for everyone and adds the Duo context if a user is a member of the DUO LDAP group.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Step 6: Same as wiki except idp.authn.resolveAttribute = assurance<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Step 7: $IDP_HOME/conf/authn/authn-comparison.xml<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><bean id="shibboleth.BetterClassRefMatchFactory" parent="shibboleth.InexactMatchFactory"><o:p></o:p></p>
<p class="MsoNormal"> <property name="matchingRules"><o:p></o:p></p>
<p class="MsoNormal"> <map><o:p></o:p></p>
<p class="MsoNormal"> <entry key="urn:oasis:names:tc:SAML:2.0:ac:classes:Password"><o:p></o:p></p>
<p class="MsoNormal"> <list><o:p></o:p></p>
<p class="MsoNormal"> <value>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</value><o:p></o:p></p>
<p class="MsoNormal"> <value><a href="http://uis.edu/duo%3c/value">http://uis.edu/duo</value</a>><o:p></o:p></p>
<p class="MsoNormal"> </list><o:p></o:p></p>
<p class="MsoNormal"> </entry><o:p></o:p></p>
<p class="MsoNormal"> <entry key="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"><o:p></o:p></p>
<p class="MsoNormal"> <list><o:p></o:p></p>
<p class="MsoNormal"> <value><a href="http://uis.edu/duo%3c/value">http://uis.edu/duo</value</a>><o:p></o:p></p>
<p class="MsoNormal"> </list><o:p></o:p></p>
<p class="MsoNormal"> </entry><o:p></o:p></p>
<p class="MsoNormal"> </map><o:p></o:p></p>
<p class="MsoNormal"> </property><o:p></o:p></p>
<p class="MsoNormal"> </bean><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Step 8: $IDP_HOME/conf/intercept/context-check-intercept-config.xml<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><bean id="shibboleth.context-check.Condition" parent="shibboleth.Conditions.AND"><o:p></o:p></p>
<p class="MsoNormal"> <constructor-arg><o:p></o:p></p>
<p class="MsoNormal"> <list><o:p></o:p></p>
<p class="MsoNormal"> <bean class="net.shibboleth.idp.profile.logic.AuthnClassPredicate"<o:p></o:p></p>
<p class="MsoNormal"> c:authnClassesToMatch-ref="authnClassesToMatch"<o:p></o:p></p>
<p class="MsoNormal"> c:authnClassesToForgive-ref="authnClassesToForgive"<o:p></o:p></p>
<p class="MsoNormal"> c:predicateToDelegate-ref="attributePredicate" /><o:p></o:p></p>
<p class="MsoNormal"> </list><o:p></o:p></p>
<p class="MsoNormal"> </constructor-arg><o:p></o:p></p>
<p class="MsoNormal"> </bean><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> <util:set id="authnClassesToMatch"><o:p></o:p></p>
<p class="MsoNormal"> <value><a href="http://uis.edu/duo%3c/value">http://uis.edu/duo</value</a>><o:p></o:p></p>
<p class="MsoNormal"> </util:set><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> <util:set id="authnClassesToForgive"><o:p></o:p></p>
<p class="MsoNormal"> <value>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</value><o:p></o:p></p>
<p class="MsoNormal"> </util:set><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"> <bean id="attributePredicate" class="net.shibboleth.idp.profile.logic.SimpleAttributePredicate"><o:p></o:p></p>
<p class="MsoNormal"> <property name="attributeValueMap"><o:p></o:p></p>
<p class="MsoNormal"> <map><o:p></o:p></p>
<p class="MsoNormal"> <entry key="assurance"><o:p></o:p></p>
<p class="MsoNormal"> <list><o:p></o:p></p>
<p class="MsoNormal"> <value><a href="http://uis.edu/duo%3c/value">http://uis.edu/duo</value</a>><o:p></o:p></p>
<p class="MsoNormal"> </list><o:p></o:p></p>
<p class="MsoNormal"> </entry><o:p></o:p></p>
<p class="MsoNormal"> </map><o:p></o:p></p>
<p class="MsoNormal"> </property><o:p></o:p></p>
<p class="MsoNormal"> </bean><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">What am I missing?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thanks in advance.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Tulio<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The idp-process.log shows:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">2015-09-30 13:20:13,480 - DEBUG [net.shibboleth.idp.attribute.resolver.AbstractAttributeDefinition:247] - Attribute Definition 'assurance': produced an attribute with the following values [StringAttributeValue{value=urn:oasis:names:tc:SAML:2.0:ac:classes:Password},
StringAttributeValue{value=http://uis.edu/duo}]<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">2015-09-30 13:20:13,483 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:432] - Attribute Resolver 'ShibbolethAttributeResolver': Attribute 'assurance' has 2 values after post-processing<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">2015-09-30 13:20:13,483 - DEBUG [net.shibboleth.idp.attribute.resolver.impl.AttributeResolverImpl:206] - Attribute Resolver 'ShibbolethAttributeResolver': Final resolved attribute collection: [assurance]<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">2015-09-30 13:20:13,502 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByAttribute:134] - Profile Action FilterFlowsByAttribute: Retaining flow authn/Password, matched custom Principal urn:oasis:names:tc:SAML:2.0:ac:classes:Password<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">2015-09-30 13:20:13,502 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByAttribute:146] - Profile Action FilterFlowsByAttribute: Potential authentication flows left after filtering: {authn/Password=AuthenticationFlowDescriptor{flowId=authn/Password,
supportsPassive=true, supportsForcedAuthentication=true, lifetime=3600000, inactivityTimeout=1800000}}<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">2015-09-30 13:20:13,507 - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:341] - Profile Action SelectAuthenticationFlow: Specific principals requested with 'exact' operator: [AuthnContextClassRefPrincipal{authnContextClassRef=http://uis.edu/duo}]<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">2015-09-30 13:20:13,507 - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:445] - Profile Action SelectAuthenticationFlow: Checking for an inactive flow or active result compatible with operator 'exact' and principal 'AuthnContextClassRefPrincipal{authnContextClassRef=http://uis.edu/duo}'<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">2015-09-30 13:20:13,508 - DEBUG [net.shibboleth.idp.authn.principal.PrincipalEvalPredicateFactoryRegistry:80] - Registry located predicate factory of type 'net.shibboleth.idp.authn.principal.impl.ExactPrincipalEvalPredicateFactory' for
principal type 'class net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal' and operator 'exact'<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">2015-09-30 13:20:13,509 - INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:475] - Profile Action SelectAuthenticationFlow: None of the potential authentication flows can satisfy the request<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">2015-09-30 13:20:13,514 - DEBUG [org.opensaml.saml.common.profile.logic.DefaultLocalErrorPredicate:184] - Error event RequestUnsupported will be handled with response<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</body>
</html>