<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p>Hi</p>
<p>I think you were experiencing the same problem as I had.</p>
<p>Perhaps it's not exactly what you are looking for, but I am
evaluating the SPNEGO activationCondition in my script as Scott
suggested. If SPNEGO for some reason fails (e.g. misconfigured
browser), this is catched (event: ReselectFlow) and fallback to
authn/Password.<br>
</p>
<p>Our SPNEGO activation condition just checks if the client IP
resides in the correct subnet. We use the SPNEGOAutoLoginManager
to check if the user opted-in for SPNEGO.<br>
</p>
<p><br>
</p>
<p><util:map id="shibboleth.authn.MFA.TransitionMap"><br>
<entry key=""><br>
<bean parent="shibboleth.authn.MFA.Transition"
p:nextFlowStrategy-ref="selectFirstFactor" /><br>
</entry><br>
<br>
<entry key="authn/SPNEGO"><br>
<bean parent="shibboleth.authn.MFA.Transition"><br>
<property name="nextFlowStrategyMap"><br>
<map><br>
<entry key="ReselectFlow"
value="authn/Password" /><br>
<entry key="proceed"
value-ref="checkSecondFactor" /><br>
</map><br>
</property><br>
</bean><br>
</entry><br>
<br>
<entry key="authn/Password"><br>
<bean parent="shibboleth.authn.MFA.Transition"
p:nextFlowStrategy-ref="checkSecondFactor" /><br>
</entry><br>
<br>
<!-- An implicit final rule will return whatever the final
flow returns. --><br>
</util:map><br>
<br>
<import
resource="../../system/flows/authn/spnego-authn-beans.xml" /><br>
<br>
<util:map id="customObjectsToSelectFirstFactor"><br>
<entry key="SPNEGOAutoLoginManager"
value-ref="SPNEGOAutoLoginManager" /><br>
<entry key="SPNEGOActicationCondition"
value-ref="shibboleth.SPNEGO.ActivationCondition" /><br>
</util:map><br>
<br>
</p>
<p><!-- See which first factor we can use (SPNEGO or Password)
--><br>
<bean id="selectFirstFactor"
parent="shibboleth.ContextFunctions.Scripted"
factory-method="inlineScript"
p:customObject-ref="customObjectsToSelectFirstFactor"><br>
<constructor-arg><br>
<value><br>
<![CDATA[<br>
nextFlow = 'authn/Password';<br>
<br>
logger =
Java.type("org.slf4j.LoggerFactory").getLogger("selectFirstFactor");<br>
logger.debug('Starting selectFirstFactor');<br>
<br>
authCtx =
input.getSubcontext("net.shibboleth.idp.authn.context.AuthenticationContext");<br>
mfaCtx =
authCtx.getSubcontext("net.shibboleth.idp.authn.context.MultiFactorAuthenticationContext");<br>
<br>
//check to see if user opt-in for SPNEGO using cookie<br>
SPNEGOAutoLoginManager =
custom.get("SPNEGOAutoLoginManager");<br>
isSPNEGOOptIn = SPNEGOAutoLoginManager.isEnabled();<br>
logger.debug('Check if SPNEGO opt-in was done through
cookie: ' + isSPNEGOOptIn );<br>
//check to see if SPNEGO can be activated<br>
SPNEGOActicationCondition =
custom.get("SPNEGOActicationCondition");<br>
isSPNEGOActivated =
SPNEGOActicationCondition.apply(input);<br>
logger.debug('Check if SPNEGO can be activated: ' +
isSPNEGOActivated );<br>
<br>
if (SPNEGOAutoLoginManager.isEnabled() &&
SPNEGOActicationCondition.apply(input)) {<br>
logger.debug('Opt-in for SPNEGO and
activationcondition is set');<br>
nextFlow = 'authn/SPNEGO';<br>
}<br>
<br>
nextFlow;<br>
]]><br>
</value><br>
</constructor-arg><br>
</bean></p>
<p><br>
</p>
<p><bean id="checkSecondFactor"
parent="shibboleth.ContextFunctions.Scripted"
factory-method="inlineScript"<br>
p:customObject-ref="shibboleth.AttributeResolverService"><br>
<constructor-arg><br>
<value><br>
<![CDATA[<br>
nextFlow = 'authn/multifactor';<br>
<br>
logger =
Java.type("org.slf4j.LoggerFactory").getLogger("checkSecondFactor");<br>
logger.debug('Starting checkSecondFactor');<br>
<br>
// Go straight to second factor if we have to, or set
up for an attribute lookup first.<br>
authCtx =
input.getSubcontext("net.shibboleth.idp.authn.context.AuthenticationContext");<br>
mfaCtx =
authCtx.getSubcontext("net.shibboleth.idp.authn.context.MultiFactorAuthenticationContext");<br>
//check is the current MFA-conftext is already
acceptable, if so check if the user did an opt-in, otherwise
finish (with value 'null')<br>
if (mfaCtx.isAcceptable()) {<br>
logger.debug('MFA context is already acceptable
but now we will check if there is an opt-in set for multifactor');<br>
// Attribute check is required to decide if first
factor alone is enough.<br>
resCtx = input.getSubcontext(<br>
"net.shibboleth.idp.attribute.resolver.context.AttributeResolutionContext",
true);<br>
resCtx.setPrincipal(input.getSubcontext(<br>
"net.shibboleth.idp.authn.context.SubjectCanonicalizationContext").getPrincipalName());<br>
logger.debug('resolving attrs for ' +
input.getSubcontext("net.shibboleth.idp.authn.context.SubjectCanonicalizationContext").getPrincipalName());<br>
resCtx.getRequestedIdPAttributeNames().add("eduPersonAssurance");<br>
resCtx.resolveAttributes(custom);<br>
<br>
// Check for an attribute that authorizes use of
first factor.<br>
attribute =
resCtx.getResolvedIdPAttributes().get("eduPersonAssurance");<br>
valueType =
Java.type("net.shibboleth.idp.attribute.StringAttributeValue");<br>
// set the nextFlow to null and exit MFA-flow
when:<br>
// a: There are no values for
eduPersonAssurance(attribute==null) -> not true in case of
opt-in<br>
// b: eduPersonAssurance is set, but does not
contain 'MobileTwoFactorContract' -> not true in case of opt-in<br>
if (attribute == null || (attribute != null
&& ! attribute.getValues().contains(new
valueType("urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorContract"))))
{<br>
nextFlow = null;<br>
}<br>
<br>
input.removeSubcontext(resCtx); // cleanup<br>
}<br>
<br>
nextFlow; // pass control to second factor or end
with the first<br>
]]><br>
</value><br>
</constructor-arg><br>
</bean><br>
</p>
Regards,<br>
Philip<br>
<p><br>
</p>
<p><br>
</p>
<p><br>
</p>
<div class="moz-cite-prefix">On 13/01/2017 17:52, Koch, Ken wrote:<br>
</div>
<blockquote
cite="mid:BLUPR02MB11076B895460EDE9B6F326CFA9780@BLUPR02MB1107.namprd02.prod.outlook.com"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Verdana;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-compose;
font-family:"Calibri",sans-serif;
color:#1F4E79;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal"><span style="color:#1F4E79">Thanks all in
advance...<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">Two reasons for
this email:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">- Seeking
validation of how we’re using the new MFA
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">- Help with
general-authn.xml SPNEGO activationCondition not firing when
MFA is enabled<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">Our intended
authN flow:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">- authn/SPNEGO
when activation condition satisfied<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">-
authn/Password if not<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">-
authn/CustomDuo(s) when SP specifies an authNContextClassRef
that matches<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">Normally, I’d
abbreviate the config but with so many people transitioning
to the new MFA router on 3.3 I figured this may be helpful
IF it’s correct.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">The MFA flow
works in our testing, but we want to make sure we’re
implementing according to the intended purposes and specs.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><b><span style="color:#1F4E79">Problem</span></b><span
style="color:#1F4E79">: The activationCondition in the
general-authn.xml for SPNEGO is NOT firing. SPNEGO works
fine, but throws SPNEGO unavailable exceptions rather than
adhering to the activationCondition logic. If we reference
SPNEGO directly in idp.properties, it works just fine. When
we call it via MFA, IDP ignores the activationCondition but
uses the SPNEGO flow. What did we do wrong?<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">Configuration
examples below.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">Our
mfa-authn-config.xml:<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><util:map
id="shibboleth.authn.MFA.TransitionMap"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <entry
key=""><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <bean
parent="shibboleth.authn.MFA.Transition"
p:nextFlowStrategy-ref="checkSPNEGO"
/> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> </entry><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <entry
key="authn/SPNEGO"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <bean
parent="shibboleth.authn.MFA.Transition"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
<property name="nextFlowStrategyMap" ><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <map><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
<entry key="ReselectFlow" value="authn/Password" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
<entry key="proceed" value-ref="checkSecondFactor" />
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> </map><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
</property><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
</bean> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> </entry><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <entry
key="authn/Password"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <bean
parent="shibboleth.authn.MFA.Transition"
p:nextFlowStrategy-ref="checkSecondFactor" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
</entry><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"></util:map><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><bean
id="checkSPNEGO"
parent="shibboleth.ContextFunctions.Scripted"
factory-method="inlineScript"
p:customObject-ref="shibboleth.HttpServletRequest"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
<constructor-arg><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
<value><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
<![CDATA[<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> var
logger =
Java.type("org.slf4j.LoggerFactory").getLogger("net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication");<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
logger.debug("MFA SPNEGO: Invoking SPNEGO");<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
nextFlow = "authn/SPNEGO";<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
nextFlow;<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> ]]><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
</value> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> </constructor-arg>
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"></bean> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><!-- Decide
if and where to route the Duo requirement to. --><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><bean
id="checkSecondFactor"
parent="shibboleth.ContextFunctions.Scripted"
factory-method="inlineScript"
p:customObject-ref="shibboleth.HttpServletRequest"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
<constructor-arg><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
<value><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
<![CDATA[ <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> var
logger =
Java.type("org.slf4j.LoggerFactory").getLogger("net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication");<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
logger.debug("MFA checkSecondFactor: Beginning decision
logic.");<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
nextFlow = null;<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> //
Setup the context classes to check status<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
authCtx =
input.getSubcontext("net.shibboleth.idp.authn.context.AuthenticationContext");<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
mfaCtx =
authCtx.getSubcontext("net.shibboleth.idp.authn.context.MultiFactorAuthenticationContext");<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> //
Make sure it's not null<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> if
(mfaCtx != null) {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> //
Check if the authContextPolicy or weighting has been
satisfied<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> if
(mfaCtx.isAcceptable()) {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
logger.debug("MFA checkSecondFactor: Policies satisfied");<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> }
else {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> //
Setup a new default nextFlow to the duo fully-enforced<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
nextFlow = "authn/duo_washu2fa_all_networks";<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> //
We need more than the basic stuff, so setup some
data
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> rpCtx
=
authCtx.getSubcontext("net.shibboleth.idp.authn.context.RequestedPrincipalContext");<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
if (rpCtx != null) {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> //
Grab the authNContextClass principals that came in the SAML
request<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
rps = rpCtx.getRequestedPrincipals();<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
// Define our own principals to use for matching<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
var AuthnContextClassRefPrincipal =
Java.type("net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal");<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
authCtxClass_external_networks = new
AuthnContextClassRefPrincipal("external_networks");<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> //
No need to use this next one because we'll default to it<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
// authCtxClass_all_networks = new
AuthnContextClassRefPrincipal("all_networks");<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
// Check for a match<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
if (rps.contains(authCtxClass_external_networks)) {<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
// Pick the duo app for off campus<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
logger.debug("MFA checkSecondFactor: Selected
external_networks");<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
nextFlow = "authn/duo_external_networks";<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
}<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> }<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> }<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> }<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
nextFlow;<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> ]]><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
</value> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> </constructor-arg>
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"></bean><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">general-authn.xml<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><bean
id="shibboleth.SPNEGO.ActivationCondition"
parent="shibboleth.Conditions.Scripted"
factory-method="inlineScript"
p:customObject-ref="shibboleth.HttpServletRequest"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
<constructor-arg><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
<value><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
<![CDATA[<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> var
logger =
Java.type("org.slf4j.LoggerFactory").getLogger("shibboleth.SPNEGO.ActivationCondition");<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
logger.debug("GenAuth SPNEGO: Beginning decision logic.");<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">… Ommitting
cookie and x-forwarded-for IP segment checking, returns
true|false …<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> ]]><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
</value><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
</constructor-arg><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"></bean><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><bean
id="authn/SPNEGO" parent="shibboleth.AuthenticationFlow"
p:nonBrowserSupported="false"
p:activationCondition-ref="shibboleth.SPNEGO.ActivationCondition"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <property
name="supportedPrincipals"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
<list><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <bean
parent="shibboleth.SAML2AuthnContextClassRef"
c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:Kerberos"
/><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <bean
parent="shibboleth.SAML1AuthenticationMethod”
c:method="urn:ietf:rfc:1510" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
</list><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
</property><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"></bean><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><bean
id="authn/duo_washu2fa_all_networks"
parent="shibboleth.AuthenticationFlow"
p:forcedAuthenticationSupported="true"
p:nonBrowserSupported="false"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <property
name="supportedPrincipals"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
<list><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <bean
parent="shibboleth.SAML2AuthnContextClassRef"
c:classRef="all_networks" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <bean
parent="shibboleth.SAML1AuthenticationMethod"
c:method="all_networks" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
</list><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
</property><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"></bean><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><bean
id="authn/duo_washu2fa_external_networks"
parent="shibboleth.AuthenticationFlow"
p:forcedAuthenticationSupported="true"
p:nonBrowserSupported="false"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <property
name="supportedPrincipals"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
<list><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <bean
parent="shibboleth.SAML2AuthnContextClassRef"
c:classRef="external_networks" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <bean
parent="shibboleth.SAML1AuthenticationMethod"
c:method="external_networks" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
</list><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
</property><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"></bean>
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><bean
id="authn/MFA" parent="shibboleth.AuthenticationFlow"
p:passiveAuthenticationSupported="true"
p:forcedAuthenticationSupported="true"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <property
name="supportedPrincipals"><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
<list><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <bean
parent="shibboleth.SAML2AuthnContextClassRef"
c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocol"
/><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <bean
parent="shibboleth.SAML2AuthnContextClassRef"
c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"
/><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <bean
parent="shibboleth.SAML2AuthnContextClassRef"
c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:Password"
/><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <bean
parent="shibboleth.SAML1AuthenticationMethod"
c:method="urn:oasis:names:tc:SAML:1.0:am:password" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <bean
parent="shibboleth.SAML2AuthnContextClassRef"
c:classRef="all_networks" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <bean
parent="shibboleth.SAML1AuthenticationMethod"
c:method="all_networks" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <bean
parent="shibboleth.SAML2AuthnContextClassRef"
c:classRef="external_networks" />
<o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <bean
parent="shibboleth.SAML1AuthenticationMethod"
c:method="external_networks" /><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"> <bean
parent="shibboleth.SAML2AuthnContextClassRef"
c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:Kerberos"
/><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
</list><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79">
</property> <o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"></bean><o:p></o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span style="color:#1F4E79"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:#1F497D">____________________________________________________________<o:p></o:p></span></p>
<p class="MsoNormal"><b><span
style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:#1F497D">Ken
Koch</span></b><span
style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:#1F497D">
| Infrastructure Architect, Enterprise Engineering<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:#1F497D">Washington
Univ</span><span
style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:#1F4E79">ersity</span><span
style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:#1F497D">
in St. Louis<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:#1F497D">7425
Forsyth Blvd., Campus Box 1110 | St. Louis, MO 63105<o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:8.0pt;font-family:"Verdana",sans-serif;color:#1F497D">w
314-935-8315 | c 314-223-7256 |
<a moz-do-not-send="true" href="mailto:ken@wustl.edu"><span
style="color:#0563C1">ken@wustl.edu</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<span
style="font-size:10.0pt;font-family:"Arial","sans-serif""><o:p></o:p></span>
<p class="MsoNormal"><o:p> </o:p></p>
<div class="MsoNormal" style="text-align:center" align="center">
<hr align="center" size="2" width="100%">
</div>
<p class="MsoNormal"><span
style="font-size:7.5pt;font-family:"Arial","sans-serif";color:gray">The
materials in this message are private and may contain
Protected Healthcare Information or other information of a
sensitive nature. If you are not the intended recipient, be
advised that any unauthorized use, disclosure, copying or the
taking of any action in reliance on the contents of this
information is strictly prohibited. If you have received this
email in error, please immediately notify the sender via
telephone or return mail.</span></p>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
</blockquote>
<br>
</body>
</html>