<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 16px; font-family: Calibri, sans-serif;">
<div>I have a use case where I have to ensure that the SP always uses Duo 2FA. I am trying to do this by forcing the IdP to always use Duo 2FA when authenticating the SP. I am doing this by adding an entry in the relying-party.xml (see below for entries
and tests). However, this only works if I have an existing session. Here is the error that I am getting in the idp-process.log:</div>
<div><br>
</div>
<div>
<div><b> 127.0.0.1|2017-01-18 14:50:20,242|208F8C77B365683C46CAA43C337A474D| - ERROR [net.shibboleth.idp.authn:-2] -</b></div>
<div><b> Uncaught runtime exception java.lang.NullPointerException: null at com.duosecurity.duoweb.DuoWeb.signRequest(DuoWeb.java:29)</b></div>
<div><b> 127.0.0.1|2017-01-18 14:50:20,250|208F8C77B365683C46CAA43C337A474D| - WARN [org.opensaml.profile.action.impl.LogEvent:105] -</b></div>
<div><b> A non-proceed event occurred while processing the request: RuntimeException</b></div>
</div>
<div><br>
</div>
<div>Note that I am testing using a clean install of IdP v3.3.0. Also, having other SP's explicitly request the Duo authnContext <a href="https://login.emory.edu/duo">https://login.emory.edu/duo</a> also works (i.e., no entry in the relying-party.xml) </div>
<div><br>
</div>
<div>What am I doing wrong? </div>
<div><br>
</div>
<div>As examples, tests 1 and 2 are what I would expect; tests 3 and 4 are where I am having problems. </div>
<div>
<div>Per the docs at <a href="https://wiki.shibboleth.net/confluence/display/IDP30/Configuring+the+IdP+for+the+Multi-Context+Broker+Model">https://wiki.shibboleth.net/confluence/display/IDP30/Configuring+the+IdP+for+the+Multi-Context+Broker+Model</a> , here
is the configuration that I am using in the <b>relying-party.xm</b>l to force Duo 2FA for the two SP's:</div>
<div> 1. </div>
<div> <bean id="SAML2.SSO.requireDuo" parent="SAML2.SSO"></div>
<div> <property name="defaultAuthenticationMethods"></div>
<div> <list></div>
<div> <bean parent="shibboleth.SAML2AuthnContextClassRef"</div>
<div> c:classRef="https://login.emory.edu/duo" /></div>
<div> </list></div>
<div> </property></div>
<div> </bean></div>
<div> </div>
<div> 2.</div>
<div> <bean parent="RelyingPartyByName" </div>
<div> c:relyingPartyIds="#{{'<b>doeLEGAL_sp</b>'}}"></div>
<div> <property name="profileConfigurations"></div>
<div> <list></div>
<div> <bean parent="SAML2.SSO.requireDuo" </div>
<div> p:encryptAssertions="false"</div>
<div> p:encryptNameIDs="false"</div>
<div> p:includeAttributeStatement="true"</div>
<div> p:signAssertions="false"</div>
<div> p:signResponses="false"</div>
<div> </div>
<div> /></div>
<div> </list></div>
<div> </property></div>
<div> </bean></div>
<div><br>
</div>
<div> <bean parent="RelyingPartyByName" </div>
<div> c:relyingPartyIds="#{{'<b>https://gerry.emory.edu</b>'}}"></div>
<div> <property name="profileConfigurations"></div>
<div> <list></div>
<div> <bean parent="SAML2.SSO.requireDuo" </div>
<div> /></div>
<div> </list></div>
<div> </property></div>
<div> </bean></div>
<div> </div>
</div>
<div><br>
</div>
<div>Following are my tests cases with results.</div>
<div>
<div> 1. Clear browser cache and close browsr.</div>
<div> First login to another app that requites normal Shibboleth auth.</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>Then login to the app doeLEGAL_sp service.</div>
<div> Results:</div>
<div> get the DUO prompt, </div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>access to the app is granted.</div>
<div> </div>
<div> 2. Clear browser cache and close browsr.</div>
<div> Login to another app that requires DUO 2FA.</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span>Then login to the app doeLEGAL_sp service.</div>
<div> Results:</div>
<div> access to the app is granted (i.e., no additional DUO prompt).</div>
<div> </div>
<div> 3. Clear browser cache and close browser.</div>
<div><span class="Apple-tab-span" style="white-space:pre"></span> Then login to the app doeLEGAL_sp service.</div>
<div> Results:</div>
<div> Get the following error in the idp-process.log:</div>
<div> </div>
<div> <b> </b>127.0.0.1|2017-01-18 14:50:20,242|208F8C77B365683C46CAA43C337A474D| - ERROR [net.shibboleth.idp.authn:-2] -</div>
<div> Uncaught runtime exception java.lang.NullPointerException: null at com.duosecurity.duoweb.DuoWeb.signRequest(DuoWeb.java:29)</div>
<div> 127.0.0.1|2017-01-18 14:50:20,250|208F8C77B365683C46CAA43C337A474D| - WARN [org.opensaml.profile.action.impl.LogEvent:105] -</div>
<div> A non-proceed event occurred while processing the request: RuntimeException</div>
<div> </div>
<div> 4. Since the SP doeLEGA_sp is a vendor app, I wanted to ensure that this is not vendor related.</div>
<div><span class="Apple-tab-span" style="white-space: pre;"></span> Get the same results and error as in #3.</div>
<div> </div>
<div> </div>
<div><br>
</div>
<div> </div>
<div> </div>
<div> </div>
<div> </div>
</div>
<div>
<div id="MAC_OUTLOOK_SIGNATURE"></div>
</div>
<br>
<hr>
<font face="Arial" color="Gray" size="1"><br>
This e-mail message (including any attachments) is for the sole use of<br>
the intended recipient(s) and may contain confidential and privileged<br>
information. If the reader of this message is not the intended<br>
recipient, you are hereby notified that any dissemination, distribution<br>
or copying of this message (including any attachments) is strictly<br>
prohibited.<br>
<br>
If you have received this message in error, please contact<br>
the sender by reply e-mail message and destroy all copies of the<br>
original message (including attachments).<br>
</font>
</body>
</html>