<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
Hello,
<div class=""><br class="">
</div>
<div class="">I have installed a Shibboleth service provider v 2.6. The configuration is as following:</div>
<div class=""><br class="">
</div>
<div class="">
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""><Location /secure></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> AuthType shibboleth</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> ShibCompatWith24 On</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> ShibRequestSetting requireSession 1</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> require shib-session</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> ShibUseHeaders On</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo; min-height: 13px;" class="">
<br class="">
</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> require valid-user</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""></Location></div>
</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""><br class="">
</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class="">
<div style="margin: 0px;" class=""><Location /twofactor></div>
<div style="margin: 0px;" class=""> AuthType shibboleth</div>
<div style="margin: 0px;" class=""> ShibUseHeaders On</div>
<div style="margin: 0px;" class=""> ShibRequestSetting authnContextClassRef <a href="http://cornell.edu/duo" class="">
http://cornell.edu/duo</a></div>
<div style="margin: 0px;" class=""> require authnContextClassRef <a href="http://cornell.edu/duo" class="">
http://cornell.edu/duo</a></div>
<div style="margin: 0px;" class=""></Location></div>
</div>
<div class=""><br class="">
</div>
<div class="">When I don’t have a session and accessed /twofactor, I was promoted for primary authentication, then duo authentication. It worked as expected. But if I accessed /secure first, I was prompted for primary authentication and a session was established.
Then I accessed /twofactor, I got "You don't have permission to access /twofactor on this server.” I was hoping SP send a new authnRequest to IDP but it didn’t. </div>
<div class=""><br class="">
</div>
<div class="">I also tried added following to shibboleth2.xml, but it doesn't help.</div>
<div class=""><br class="">
</div>
<div class="">
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""><SessionInitiator type="SAML2" id="Login" Location="/twofactor"</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> entityID="<a href="https://shibidp-test.cit.cornell.edu/idp/shibboleth" class="">https://shibidp-test.cit.cornell.edu/idp/shibboleth</a>"</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> authnContextClassRef="<a href="http://cornell.edu/duo" class="">http://cornell.edu/duo</a>"</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> forceAuthn="true" /></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""><br class="">
</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class="">How to make SP re-send authnRequest?</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""><br class="">
</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class="">Thanks,</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""><br class="">
</div>
<div apple-content-edited="true" class="">
<div class="">
<div style="orphans: 2; widows: 2;" class="">Hong</div>
</div>
</div>
</div>
</body>
</html>