<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 14 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
@font-face
{font-family:Menlo;
panose-1:0 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
pre
{mso-style-priority:99;
mso-style-link:"HTML Preformatted Char";
margin:0in;
margin-bottom:.0001pt;
font-size:10.0pt;
font-family:"Courier New";}
span.HTMLPreformattedChar
{mso-style-name:"HTML Preformatted Char";
mso-style-priority:99;
mso-style-link:"HTML Preformatted";
font-family:Consolas;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Dave,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Question regarding “opt-in”.. having gone through the dosc (<a href="https://wiki.shibboleth.net/confluence/pages/viewpage.action?pageId=20807829">https://wiki.shibboleth.net/confluence/pages/viewpage.action?pageId=20807829</a>)
and done a significant amount of testing, I see no option for a user to either opt-in or out of Duo when using a simple Password login… am I missing something?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Thanks,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">Mark<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div>
<p class="MsoNormal"><b><span style="font-family:"Arial","sans-serif";color:#0070C0">Mark L. Boyce</span></b><span style="color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial","sans-serif";color:#7F7F7F">Senior Identity Management Analyst<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial","sans-serif";color:#7F7F7F">University of California, Office of the President<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span style="font-size:10.0pt;font-family:"Tahoma","sans-serif""> users [mailto:users-bounces@shibboleth.net]
<b>On Behalf Of </b>David Langenberg<br>
<b>Sent:</b> Wednesday, September 09, 2015 11:59 AM<br>
<b>To:</b> Shib Users<br>
<b>Subject:</b> Re: MCB in IDP 3<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Ok, now, make the resolver return PasswordProtectedTransport if not Duo.
<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Dave<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">On Sep 9, 2015, at 12:57 PM, Hong Ye <<a href="mailto:hy93@cornell.edu">hy93@cornell.edu</a>> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">Hi Dave, <o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thank you very much for your advice. I removed step 8 and modified resolver to return nothing if user not opt-in DUO that resolved the case #2. But case #1 still doesn’t work. <o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Hong<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On Sep 9, 2015, at 2:18 PM, David Langenberg <<a href="mailto:davel@uchicago.edu">davel@uchicago.edu</a>> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><br>
<br>
<o:p></o:p></p>
<div>
<p class="MsoNormal">The idea behind step 8 is to assist with the fact that Password => Silver for us. I don't believe step 8 is necessary in your case. As for your attribute-resolver, we don't ever return :unspecified from the resolver. The results for
the default case are always the PasswordProtectedTransport class. The IdP treats :unspecified very different than any other context class, so I'd try first fixing your resolver and seeing if that helps any.
<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Dave<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
<div>
<p class="MsoNormal">On Sep 9, 2015, at 11:32 AM, Hong Ye <<a href="mailto:hy93@cornell.edu">hy93@cornell.edu</a>> wrote:<o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">Hi, <o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">I did similar configuration as described in <a href="https://wiki.shibboleth.net/confluence/pages/viewpage.action?pageId=20807829">https://wiki.shibboleth.net/confluence/pages/viewpage.action?pageId=20807829</a>. Our IDP use Remote User
as primary log in so I made some changes in the configuration. It works as expected if the AuthnContextClass was not sent in the AuthnRequest or AuthnContextClassRef specified in the AuthnRequest is the same as the resolved value of eduPersonAssurance. Otherwise
it didn’t work.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Case 1:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">if remoteUser class ref is specified in AuthnContextClassRef of AuthnRequest, but user opt in in DUO. After primary authentication, IDP sent back error status<o:p></o:p></p>
</div>
<div>
<pre id="txt"><saml2p:Status><o:p></o:p></pre>
<pre> <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Requester"><o:p></o:p></pre>
<pre> <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:NoAuthnContext" /><o:p></o:p></pre>
<pre> </saml2p:StatusCode><o:p></o:p></pre>
<pre> <saml2p:StatusMessage>authn</saml2p:StatusMessage><o:p></o:p></pre>
<pre></saml2p:Status><o:p></o:p></pre>
<div>
<p class="MsoNormal">Right now I don’t care about user should be promoted for DUO or not in this case. But I don’t expect IDP sent back error status.<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Case 2:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">If duo class ref is specified in AuthnContextClassRef of AuthnRequest, but user doesn’t opt in in DUO. After primary authentication, user was prompted for DUO. Even though user finished DUO authentication, IDP still sent back error status.<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<pre id="txt"><saml2p:Status><o:p></o:p></pre>
<pre> <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Requester"><o:p></o:p></pre>
<pre> <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:NoAuthnContext" /><o:p></o:p></pre>
<pre> </saml2p:StatusCode><o:p></o:p></pre>
<pre> <saml2p:StatusMessage>authn</saml2p:StatusMessage><o:p></o:p></pre>
<pre></saml2p:Status><o:p></o:p></pre>
<div>
<p class="MsoNormal">In this case, I think DUO should be prompted no matter user opt in or not. But IDP shouldn’t send back error status after successful DUO login.<o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Here are all the steps I did:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Step1,2 exactly the same as the wiki page<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Step 3: global.xml<o:p></o:p></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""> <bean id="authn/Duo" parent="shibboleth.AuthenticationFlow"<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""> p:nonBrowserSupported="false" p:forcedAuthenticationSupported="%{duo.forcedAuthenticationSupported:true}"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""> <property name="supportedPrincipals"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""> <util:list><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""> <bean parent="shibboleth.SAML2AuthnContextClassRef"<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""> c:classRef="<a href="http://cornell.edu/duo">http://cornell.edu/duo</a>" /><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""> <bean parent="shibboleth.SAML1AuthenticationMethod"<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""> c:method="<a href="http://cornell.edu/duo">http://cornell.edu/duo</a>" /><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""> </util:list><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""> </property><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""> </bean><o:p></o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal">Step 4<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Step 5. attribute-resolver.xml<o:p></o:p></p>
</div>
<div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Value "<span style="font-size:8.5pt;font-family:"Menlo","serif""><a href="http://cornell.edu/duo%E2%80%9D">http://cornell.edu/duo”</a> is returned for eduPersonAssurance when user opt in DUO</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif"">Otherwise ""urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified”</span><o:p></o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">step 6: same<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Step 7: authn-comparison.xml<o:p></o:p></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""><bean id="shibboleth.BetterClassRefMatchFactory" parent="shibboleth.InexactMatchFactory"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""> <property name="matchingRules"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""> <util:map><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""> <entry key="urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""> <list><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""> <value><a href="http://cornell.edu/duo%3C/value%3E">http://cornell.edu/duo</value></a><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""> </list><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""> </entry><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""> </util:map><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""> </property><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""> </bean><o:p></o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Step 8 <span style="font-size:8.5pt;font-family:"Menlo","serif"">context-check-intercept-config.xml </span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""><bean id="shibboleth.context-check.Condition" parent="shibboleth.Conditions.AND"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""> <constructor-arg><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""> <list><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""> <bean class="net.shibboleth.idp.profile.logic.AuthnClassPredicate"<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""> c:authnClassesToMatch-ref="authnClassesToMatch"<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""> c:predicateToDelegate-ref="attributePredicate" /><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""> </list><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""> </constructor-arg><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""> </bean><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""> <util:set id="authnClassesToMatch"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""> <value><a href="http://cornell.edu/duo%3C/value%3E">http://cornell.edu/duo</value></a><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""> </util:set><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""> <bean id="attributePredicate" class="net.shibboleth.idp.profile.logic.SimpleAttributePredicate"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""> <property name="attributeValueMap"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""> <map><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""> <entry key="eduPersonAssurance"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""> <list><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""> <value><a href="http://cornell.edu/duo%3C/value%3E">http://cornell.edu/duo</value></a><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""> </list><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""> </entry><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""> </map><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""> </property><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal"><span style="font-size:8.5pt;font-family:"Menlo","serif""> </bean><o:p></o:p></span></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Anything wrong with the configuration?<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Thanks,<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal">Hong<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal">-- <br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a><o:p></o:p></p>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">--<br>
David Langenberg<br>
Identity & Access Management Architect<br>
The University of Chicago<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<p class="MsoNormal">-- <br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a><o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<p class="MsoNormal">-- <br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a><o:p></o:p></p>
</div>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">--<br>
David Langenberg<br>
Identity & Access Management Architect<br>
The University of Chicago<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>