<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div class="">Hello,</div>
<div class=""><br class="">
</div>
<div class="">I’m having exactly the same issue described in this thread:</div>
<div class="">(<span style="orphans: 2; widows: 2;" class="">If I go to first the non-Duo requiring SP, I am prompted for password then sent to the SP. If I then go to the optionally Duo-requiring SP, it never seems to perform the MFA flow to check for second
factor. )<br class="">
</span><a href="http://shibboleth.1660669.n2.nabble.com/IDPv3-3-and-programmatically-selecting-MFA-based-on-attribute-td7630903.html" class="">http://shibboleth.1660669.n2.nabble.com/IDPv3-3-and-programmatically-selecting-MFA-based-on-attribute-td7630903.html</a></div>
<div apple-content-edited="true" class="">
<div class="">
<div style="orphans: 2; widows: 2;" class=""><br class="">
</div>
</div>
<div style="orphans: 2; widows: 2;" class=""><br class="">
</div>
<div style="orphans: 2; widows: 2;" class="">I tried the solution posted by Scott Koranda in that thread. It still doesn’t work for me. Our primary authentication is authn/RemoteUser. I’m sure I’m missing something in my configuration, but I can't’ figured
it out. </div>
<div style="orphans: 2; widows: 2;" class=""><br class="">
</div>
<div style="orphans: 2; widows: 2;" class="">In idp.<span style="font-family: Menlo; font-size: 11px;" class="">properties:</span></div>
<div style="orphans: 2; widows: 2;" class="">
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class="">idp.authn.flows= MFA</div>
</div>
<div style="orphans: 2; widows: 2;" class="">
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class="">idp.authn.favorSSO = false</div>
</div>
<div style="orphans: 2; widows: 2;" class=""><br class="">
</div>
<div style="orphans: 2; widows: 2;" class=""><br class="">
</div>
<div style="orphans: 2; widows: 2;" class="">I added following to DefaultRelyingParty:</div>
<div style="orphans: 2; widows: 2;" class="">
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""><bean parent="SAML2.SSO"></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> <property name="defaultAuthenticationMethods"></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> <list></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> <bean parent="shibboleth.SAML2AuthnContextClassRef"</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> c:classRef="<a href="http://cornell.edu/mfa" class="">http://cornell.edu/mfa</a>" /></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> <bean parent="shibboleth.SAML2AuthnContextClassRef"</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" /></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> </list></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> </property></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""></bean></div>
<div class=""><br class="">
</div>
<div class="">
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class="">general-authn.xml </div>
</div>
<div class="">
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""><bean id="authn/Duo" parent="shibboleth.AuthenticationFlow"</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> p:forcedAuthenticationSupported="true"</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> p:nonBrowserSupported="false"></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> </div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> <property name="supportedPrincipals"></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> <list></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> <bean parent="shibboleth.SAML2AuthnContextClassRef"</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> c:classRef="<a href="http://cornell.edu/mfa" class="">http://cornell.edu/mfa</a>" /></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> <bean parent="shibboleth.SAML1AuthenticationMethod"</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> c:method="<a href="http://cornell.edu/mfa" class="">http://cornell.edu/mfa</a>" /></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> </list></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> </property></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""></bean></div>
</div>
<div class=""><br class="">
</div>
<div class="">
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""><bean id="authn/MFA" parent="shibboleth.AuthenticationFlow"</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> p:passiveAuthenticationSupported="true"</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> p:forcedAuthenticationSupported="true"></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> </div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> <property name="supportedPrincipals"></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> <list></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> </div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> <bean parent="shibboleth.SAML2AuthnContextClassRef"</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocol" /></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> <bean parent="shibboleth.SAML2AuthnContextClassRef"</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" /></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> <bean parent="shibboleth.SAML2AuthnContextClassRef"</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:Password" /></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> <bean parent="shibboleth.SAML1AuthenticationMethod"</div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> c:method="urn:oasis:names:tc:SAML:1.0:am:password" /></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> </list></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""> </property></div>
<div style="margin: 0px; font-size: 11px; font-family: Menlo;" class=""></bean></div>
</div>
<div class=""><br class="">
</div>
<div class="">Thanks!</div>
<div class=""><br class="">
</div>
</div>
<div style="orphans: 2; widows: 2;" class="">Hong</div>
</div>
<br class="">
</body>
</html>