<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p>Thanks Scott, I've reverted that configuration back.</p>
<p>I've found this page in searching:
<a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/IDP30/SAML2SSOConfiguration#SAML2SSOConfiguration-Authentication">https://wiki.shibboleth.net/confluence/display/IDP30/SAML2SSOConfiguration#SAML2SSOConfiguration-Authentication</a></p>
<p>And I've applied a configuration as follows:</p>
<p>
<blockquote type="cite"><bean parent="RelyingPartyByName"
c:relyingPartyIds=<a class="moz-txt-link-rfc2396E"
href="https://it-federation2.jmu.edu/shibboleth">"https://it-federation2.jmu.edu/shibboleth"</a>>
<br>
<property name="profileConfigurations">
<br>
<list>
<br>
<bean parent="SAML2.SSO"
p:disallowedFeatures-ref="SAML2.SSO.FEATURE_AUTHNCONTEXT">
<br>
<property
name="defaultAuthenticationMethods">
<br>
<list>
<br>
<ref bean="MFASAML2Principal"
/>
<br>
</list>
<br>
</property>
<br>
</bean>
<br>
</list>
<br>
</property>
<br>
</bean>
</blockquote>
Then I added this just under the initial bean stanza:</p>
<p>
<blockquote type="cite"><bean id="MFASAML2Principal"
parent="shibboleth.SAML2AuthnContextClassRef" c:classRef=<a
class="moz-txt-link-rfc2396E"
href="https://example.org/shibboleth/ac/classes/mfa">"https://example.org/shibboleth/ac/classes/mfa"</a>
/>
</blockquote>
</p>
<p>Unfortunately now I get this:</p>
<p>
<blockquote type="cite">2017-03-29 13:43:51,136 - DEBUG
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:370] -
Profile Action SelectAuthenticationFlow: Specific principals
requested with 'exact' operator:
[AuthnContextClassRefPrincipal{authnContextClassRef=<a
class="moz-txt-link-freetext"
href="https://example.org/shibboleth/ac/classes/mfa">https://example.org/shibboleth/ac/classes/mfa</a>}]
<br>
2017-03-29 13:43:51,137 - DEBUG
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:386] -
Profile Action SelectAuthenticationFlow: No active results
available, selecting an inactive flow
<br>
2017-03-29 13:43:51,137 - DEBUG
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:407] -
Profile Action SelectAuthenticationFlow: Checking for an
inactive flow compatible with operator 'exact' and principal '<a
class="moz-txt-link-freetext"
href="https://example.org/shibboleth/ac/classes/mfa">https://example.org/shibboleth/ac/classes/mfa</a>'
<br>
2017-03-29 13:43:51,138 - DEBUG
[net.shibboleth.idp.authn.principal.PrincipalEvalPredicateFactoryRegistry:82]
- Registry located predicate factory of type
'net.shibboleth.idp.authn.principal.impl.ExactPrincipalEvalPredicateFactory'
for principal type 'class
net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal'
and operator 'exact'
<br>
2017-03-29 13:43:51,139 - INFO
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:428] -
Profile Action SelectAuthenticationFlow: None of the potential
authentication flows can satisfy the request
<br>
2017-03-29 13:43:51,167 - WARN
[org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed
event occurred while processing the request: RequestUnsupported
<br>
2017-03-29 13:43:51,179 - DEBUG
[org.opensaml.saml.common.profile.logic.DefaultLocalErrorPredicate:184]
- Error event RequestUnsupported will be handled with response</blockquote>
Am I missing something? Am I on the right track?</p>
<p>Thanks,<br>
</p>
<pre class="moz-signature" cols="72">--
Brandon McKean
IT / Systems
Linux Administrator
(540)568-4235</pre>
<div class="moz-cite-prefix">On 03/29/2017 12:07 PM, Cantor, Scott
wrote:<br>
</div>
<blockquote cite="mid:BC4A3C9D-6F8D-4E32-9337-B96212EE7AC8@osu.edu"
type="cite">
<pre wrap="">On 3/29/17, 11:56 AM, "users on behalf of Brandon McKean" <a class="moz-txt-link-rfc2396E" href="mailto:users-bounces@shibboleth.netonbehalfofmckeanbs@jmu.edu"><users-bounces@shibboleth.net on behalf of mckeanbs@jmu.edu></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">I'm trying to find a good way to force Duo use through the MFA flow
within the code stanza.
</pre>
</blockquote>
<pre wrap="">
That's not the right spot. You control it by setting the appropriate custom Principal inside the defaultAuthenticationMethods property on the relying party side, and in parallel requiring signed requests or blocking the RequestedAuthnContext "feature" for that SP, so that the imposed requirement can't be overridden. There are examples on that in the documentation.
</pre>
<blockquote type="cite">
<pre wrap="">Here's what I'm wanting to change:
</pre>
</blockquote>
<pre wrap="">
You don't want to change that, it's already correct for this case.
</pre>
<blockquote type="cite">
<pre wrap="">What I'm wanting to do is force it by entityID. I thought that'd be
something done in the relying-party but I can't find any options for that.
</pre>
</blockquote>
<pre wrap="">
See above.
Look at the RelyingPartyConfiguration topic, scroll down to the profile-specific configuration part, and click on, probably, the SAML 2 SSO link. That has sections covering different options, one of which is Authentication related settings, and this is covered there with a full example that's safe.
Of course, all of this is covering for a broken SP. The SP should be requesting this itself. (Not saying it's not necessary, but it's always important to understand this. When you talk about it, it's useful to emphasize to people that "hey, this application is broken" so they understand that you did work you shouldn't have had to do.)
-- Scott
</pre>
</blockquote>
<br>
</body>
</html>