<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:#1F4E79;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F4E79">Thanks all in advance...<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">Two reasons for this email:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">- Seeking validation of how we’re using the new MFA
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">- Help with general-authn.xml SPNEGO activationCondition not firing when MFA is enabled<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">Our intended authN flow:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">- authn/SPNEGO when activation condition satisfied<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">- authn/Password if not<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">- authn/CustomDuo(s) when SP specifies an authNContextClassRef that matches<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">Normally, I’d abbreviate the config but with so many people transitioning to the new MFA router on 3.3 I figured this may be helpful IF it’s correct.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">The MFA flow works in our testing, but we want to make sure we’re implementing according to the intended purposes and specs.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="color:#1F4E79">Problem</span></b><span style="color:#1F4E79">: The activationCondition in the general-authn.xml for SPNEGO is NOT firing. SPNEGO works fine, but throws SPNEGO unavailable exceptions rather than adhering to
the activationCondition logic. If we reference SPNEGO directly in idp.properties, it works just fine. When we call it via MFA, IDP ignores the activationCondition but uses the SPNEGO flow. What did we do wrong?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">Configuration examples below.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">Our mfa-authn-config.xml:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><util:map id="shibboleth.authn.MFA.TransitionMap"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <entry key=""><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <bean parent="shibboleth.authn.MFA.Transition" p:nextFlowStrategy-ref="checkSPNEGO" /> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> </entry><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <entry key="authn/SPNEGO"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <bean parent="shibboleth.authn.MFA.Transition"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <property name="nextFlowStrategyMap" ><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <map><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <entry key="ReselectFlow" value="authn/Password" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <entry key="proceed" value-ref="checkSecondFactor" />
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> </map><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> </property><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> </bean> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> </entry><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <entry key="authn/Password"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <bean parent="shibboleth.authn.MFA.Transition" p:nextFlowStrategy-ref="checkSecondFactor" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> </entry><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"></util:map><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><bean id="checkSPNEGO" parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript" p:customObject-ref="shibboleth.HttpServletRequest"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <constructor-arg><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <value><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <![CDATA[<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> var logger = Java.type("org.slf4j.LoggerFactory").getLogger("net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication");<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> logger.debug("MFA SPNEGO: Invoking SPNEGO");<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> nextFlow = "authn/SPNEGO";<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> nextFlow;<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> ]]><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> </value> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> </constructor-arg> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"></bean> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><!-- Decide if and where to route the Duo requirement to. --><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><bean id="checkSecondFactor" parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript" p:customObject-ref="shibboleth.HttpServletRequest"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <constructor-arg><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <value><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <![CDATA[ <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> var logger = Java.type("org.slf4j.LoggerFactory").getLogger("net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication");<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> logger.debug("MFA checkSecondFactor: Beginning decision logic.");<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> nextFlow = null;<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> // Setup the context classes to check status<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> authCtx = input.getSubcontext("net.shibboleth.idp.authn.context.AuthenticationContext");<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> mfaCtx = authCtx.getSubcontext("net.shibboleth.idp.authn.context.MultiFactorAuthenticationContext");<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> // Make sure it's not null<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> if (mfaCtx != null) {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> // Check if the authContextPolicy or weighting has been satisfied<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> if (mfaCtx.isAcceptable()) {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> logger.debug("MFA checkSecondFactor: Policies satisfied");<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> } else {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> // Setup a new default nextFlow to the duo fully-enforced<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> nextFlow = "authn/duo_washu2fa_all_networks";<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> // We need more than the basic stuff, so setup some data
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> rpCtx = authCtx.getSubcontext("net.shibboleth.idp.authn.context.RequestedPrincipalContext");<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> if (rpCtx != null) {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> // Grab the authNContextClass principals that came in the SAML request<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> rps = rpCtx.getRequestedPrincipals();<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> // Define our own principals to use for matching<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> var AuthnContextClassRefPrincipal = Java.type("net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal");<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> authCtxClass_external_networks = new AuthnContextClassRefPrincipal("external_networks");<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> // No need to use this next one because we'll default to it<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> // authCtxClass_all_networks = new AuthnContextClassRefPrincipal("all_networks");<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> // Check for a match<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> if (rps.contains(authCtxClass_external_networks)) {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> // Pick the duo app for off campus<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> logger.debug("MFA checkSecondFactor: Selected external_networks");<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> nextFlow = "authn/duo_external_networks";<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> }<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> }<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> }<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> }<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> nextFlow;<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> ]]><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> </value> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> </constructor-arg> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"></bean><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">general-authn.xml<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><bean id="shibboleth.SPNEGO.ActivationCondition" parent="shibboleth.Conditions.Scripted" factory-method="inlineScript" p:customObject-ref="shibboleth.HttpServletRequest"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <constructor-arg><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <value><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <![CDATA[<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> var logger = Java.type("org.slf4j.LoggerFactory").getLogger("shibboleth.SPNEGO.ActivationCondition");<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> logger.debug("GenAuth SPNEGO: Beginning decision logic.");<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">… Ommitting cookie and x-forwarded-for IP segment checking, returns true|false …<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> ]]><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> </value><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> </constructor-arg><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"></bean><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><bean id="authn/SPNEGO" parent="shibboleth.AuthenticationFlow" p:nonBrowserSupported="false" p:activationCondition-ref="shibboleth.SPNEGO.ActivationCondition"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <property name="supportedPrincipals"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <list><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <bean parent="shibboleth.SAML2AuthnContextClassRef" c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:Kerberos" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <bean parent="shibboleth.SAML1AuthenticationMethod” c:method="urn:ietf:rfc:1510" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> </list><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> </property><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"></bean><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><bean id="authn/duo_washu2fa_all_networks" parent="shibboleth.AuthenticationFlow" p:forcedAuthenticationSupported="true" p:nonBrowserSupported="false"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <property name="supportedPrincipals"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <list><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <bean parent="shibboleth.SAML2AuthnContextClassRef" c:classRef="all_networks" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <bean parent="shibboleth.SAML1AuthenticationMethod" c:method="all_networks" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> </list><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> </property><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"></bean><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><bean id="authn/duo_washu2fa_external_networks" parent="shibboleth.AuthenticationFlow" p:forcedAuthenticationSupported="true" p:nonBrowserSupported="false"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <property name="supportedPrincipals"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <list><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <bean parent="shibboleth.SAML2AuthnContextClassRef" c:classRef="external_networks" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <bean parent="shibboleth.SAML1AuthenticationMethod" c:method="external_networks" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> </list><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> </property><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"></bean> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><bean id="authn/MFA" parent="shibboleth.AuthenticationFlow" p:passiveAuthenticationSupported="true" p:forcedAuthenticationSupported="true"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <property name="supportedPrincipals"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <list><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <bean parent="shibboleth.SAML2AuthnContextClassRef" c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocol" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <bean parent="shibboleth.SAML2AuthnContextClassRef" c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <bean parent="shibboleth.SAML2AuthnContextClassRef" c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:Password" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <bean parent="shibboleth.SAML1AuthenticationMethod" c:method="urn:oasis:names:tc:SAML:1.0:am:password" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <bean parent="shibboleth.SAML2AuthnContextClassRef" c:classRef="all_networks" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <bean parent="shibboleth.SAML1AuthenticationMethod" c:method="all_networks" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <bean parent="shibboleth.SAML2AuthnContextClassRef" c:classRef="external_networks" />
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <bean parent="shibboleth.SAML1AuthenticationMethod" c:method="external_networks" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <bean parent="shibboleth.SAML2AuthnContextClassRef" c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:Kerberos" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> </list><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> </property> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"></bean><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:#1F497D">____________________________________________________________<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:#1F497D">Ken Koch</span></b><span style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:#1F497D"> | Infrastructure Architect, Enterprise Engineering<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:#1F497D">Washington Univ</span><span style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:#1F4E79">ersity</span><span style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:#1F497D">
in St. Louis<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:#1F497D">7425 Forsyth Blvd., Campus Box 1110 | St. Louis, MO 63105<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:#1F497D">w 314-935-8315 | c 314-223-7256 |
<a href="mailto:ken@wustl.edu"><span style="color:#0563C1">ken@wustl.edu</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<span style="font-size:10.0pt;font-family:"Arial","sans-serif""><o:p></o:p></span>
<p></p>
<div></div>
<p class="MsoNormal"><o:p> </o:p></p>
<div class="MsoNormal" align="center" style="text-align:center">
<hr size="2" width="100%" align="center">
</div>
<p class="MsoNormal"><span style="font-size:7.5pt;font-family:"Arial","sans-serif";color:gray">The materials in this message are private and may contain Protected Healthcare Information or other information of a sensitive nature. If you are not the intended
recipient, be advised that any unauthorized use, disclosure, copying or the taking of any action in reliance on the contents of this information is strictly prohibited. If you have received this email in error, please immediately notify the sender via telephone
or return mail.</span></p>
</body>
</html>