<div dir="ltr">You might have a syntax error... our version looks like this...<div><br></div><div>p:defaultAuthenticationMethods="#{{'urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken'}}"<br></div><div><br></div><div>Liam</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Dec 12, 2016 at 3:48 PM, Wessel, Keith <span dir="ltr"><<a href="mailto:kwessel@illinois.edu" target="_blank">kwessel@illinois.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Hello, all,<br>
<br>
Our ADFS folks want Duo enabled for their Shib integration. Following the V3 relying party docs, I added this bean to my relying-party.xml:<br>
<br>
        <bean parent="RelyingPartyByName" c:relyingPartyIds="<a href="http://sts.exchangetest.illinois.edu/adfs/services/trust" rel="noreferrer" target="_blank">http://sts.<wbr>exchangetest.illinois.edu/<wbr>adfs/services/trust</a>"><br>
            <property name="profileConfigurations"><br>
                <list><br>
                    <bean parent="SAML2.SSO" p:<wbr>defaultAuthenticationMethods="<wbr>#{'urn:mace:incommon:<a href="http://uiuc.edu">uiuc.edu</a>:<wbr>duo'}" /><br>
                </list><br>
            </property><br>
        </bean><br>
<br>
And we get a relying party configuration error when they try to log in. Logs aren't telling me much more than that, even with net/shibboleth.idp and org.opensaml.saml turned up to debug.<br>
<br>
Is urn:mace:incommon:uiuc.edu:duo a valid authentication method principal if it's what we're using the request and assert MFA? Wondering if that's the right value to be passing to the defaultAuthenticationMethods property.<br>
<br>
Thanks,<br>
Keith<br>
<span class="HOEnZb"><font color="#888888"><br>
--<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br>
</font></span></blockquote></div><br></div>