<div dir="ltr">Hi,<div><br></div><div>I've been working on updating the shib-mfa-u2f-auth plugin to fully support IdP v3.3 and the MFA flow. The plugin works but with one little exception, I can't get the MFA flow to send the correct AuthnContextClassRef back in the SAML response. Not even when the SP requests the specific one that I'd expect. I'm not sure if this is a configuration error or if I'm missing a vital part in my code for this to work. I'm expecting "<a href="http://stderr.eu/u2f">http://stderr.eu/u2f</a>" but I get "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport". I'm having a hunch that the problem might be related to the use of my U2fPrincipal and populateSubject(), but I'm not sure.</div><div><br></div><div>This is my current configuration which is pretty straight forward. Only the MFA flow is enabled in idp.properties.</div><div><br></div><div>general-auth.xml:</div><div><br></div><div><div>        <bean id="authn/MFA" parent="shibboleth.AuthenticationFlow"</div><div>                p:passiveAuthenticationSupported="true"</div><div>                p:forcedAuthenticationSupported="true"></div><div> </div><div>            <property name="supportedPrincipals"></div><div>                <list></div><div>                    <bean parent="shibboleth.SAML2AuthnContextClassRef"</div><div>                       c:classRef="<a href="http://stderr.eu/u2f">http://stderr.eu/u2f</a>" /></div><div>                    <bean parent="shibboleth.SAML2AuthnContextClassRef"</div><div>                        c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" /></div><div>                    <bean parent="shibboleth.SAML2AuthnContextClassRef"</div><div>                        c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:Password" /></div><div>                </list></div><div>            </property></div><div>        </bean></div><div><br></div><div>        <bean id="authn/U2f" parent="shibboleth.AuthenticationFlow"</div><div>          p:passiveAuthenticationSupported="true" p:forcedAuthenticationSupported="true"></div><div>        <property name="supportedPrincipals"></div><div>            <util:list></div><div>                <bean parent="shibboleth.SAML2AuthnContextClassRef"</div><div>                      c:classRef="<a href="http://stderr.eu/u2f">http://stderr.eu/u2f</a>" /></div><div>                <bean parent="shibboleth.SAML1AuthenticationMethod"</div><div>                      c:method="<a href="http://stderr.eu/u2f">http://stderr.eu/u2f</a>" /></div><div>            </util:list></div><div>        </property></div><div>    </bean></div></div><div><br></div><div><br></div><div>mfa-authn-config.xml:</div><div><br></div><div><div> <entry key=""></div><div>            <bean parent="shibboleth.authn.MFA.Transition" p:nextFlow="authn/Password" /></div><div> </entry></div></div><div><div> <entry key="authn/Password"></div><div>            <bean parent="shibboleth.authn.MFA.Transition" p:nextFlow="authn/U2f" /></div><div> </entry></div></div><div><br></div><div><br></div><div>A few log entries:</div><div><br></div><div><div>2017-03-28 13:09:46,920 - INFO [eu.stderr.shibboleth.idp.u2f.authn.impl.ValidateResponse:129] - Profile Action ValidateResponse: U2F login successful</div><div>2017-03-28 13:09:46,922 - DEBUG [net.shibboleth.idp.authn.AbstractValidationAction:341] - Profile Action ValidateResponse: Adding custom Principal(s) defined on underlying flow descriptor</div><div>2017-03-28 13:09:46,926 - DEBUG [eu.stderr.shibboleth.idp.u2f.authn.impl.ValidateResponse:142] - Profile Action ValidateResponse: subjects [AuthnContextClassRefPrincipal{authnContextClassRef=<a href="http://stderr.eu/u2f">http://stderr.eu/u2f</a>}</div><div>, AuthenticationMethodPrincipal{authnMethod=<a href="http://stderr.eu/u2f">http://stderr.eu/u2f</a>}]</div></div><div><div>2017-03-28 13:09:46,961 - DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:184] - Profile Action TransitionMultiFactorAuthentication: Preserving authentication result from 'authn/U2f' flow</div><div>2017-03-28 13:09:46,962 - DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:197] - Profile Action TransitionMultiFactorAuthentication: Applying MFA transition rule to exit state 'authn/U2f'</div><div>2017-03-28 13:09:46,962 - DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:219] - Profile Action TransitionMultiFactorAuthentication: MFA flow completing with event 'proceed'</div><div>2017-03-28 13:09:46,971 - DEBUG [net.shibboleth.idp.authn.impl.FinalizeMultiFactorAuthentication:193] - Profile Action FinalizeMultiFactorAuthentication: MFA complete, producing merged result</div><div>2017-03-28 13:09:46,983 - DEBUG [net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext:79] - Profile Action PopulateSubjectCanonicalizationContext: Installing 2 canonicalization flows into SubjectC</div><div>anonicalizationContext</div></div><div><div>2017-03-28 13:09:46,984 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] - Profile Action SelectSubjectCanonicalizationFlow: Checking canonicalization flow c14n/x500 for applicability</div><div>...</div><div>2017-03-28 13:09:46,985 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:106] - Profile Action SelectSubjectCanonicalizationFlow: Canonicalization flow c14n/x500 was not applicable to this</div><div> request</div><div>2017-03-28 13:09:46,985 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] - Profile Action SelectSubjectCanonicalizationFlow: Checking canonicalization flow c14n/simple for applicabili</div><div>ty...</div><div>2017-03-28 13:09:46,986 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:83] - Profile Action SelectSubjectCanonicalizationFlow: Selecting canonicalization flow c14n/simple</div><div>2017-03-28 13:09:46,994 - DEBUG [net.shibboleth.idp.authn.AbstractSubjectCanonicalizationAction:226] - Profile Action SimpleSubjectCanonicalization: trimming whitespace of input string 'user-2'</div><div>2017-03-28 13:09:47,014 - DEBUG [net.shibboleth.idp.authn.impl.FinalizeAuthentication:137] - Profile Action FinalizeAuthentication: Canonical principal name was established as 'user-2'</div><div>2017-03-28 13:09:47,015 - DEBUG [net.shibboleth.idp.authn.impl.FinalizeAuthentication:242] - Profile Action FinalizeAuthentication: Checking result for compatibility with operator 'exact' and principal 'urn:oasis</div><div>:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport'</div><div>2017-03-28 13:09:47,015 - DEBUG [net.shibboleth.idp.authn.principal.PrincipalEvalPredicateFactoryRegistry:82] - Registry located predicate factory of type 'net.shibboleth.idp.authn.principal.impl.ExactPrincipalEv</div><div>alPredicateFactory' for principal type 'class net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal' and operator 'exact'</div><div>2017-03-28 13:09:47,016 - DEBUG [net.shibboleth.idp.authn.impl.FinalizeAuthentication:262] - Profile Action FinalizeAuthentication: Principal 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport' in</div><div> authentication result satisfies request for principal 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport'</div></div><div><br></div><div><br></div><div><br></div><div>Any help pointing me in the right direction would be very much appreciated.</div><div><br></div><div>Thanks!</div><div><br></div><div>Best regards,</div><div>Stefan</div></div>