<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;">
<div>This has been an interesting conversation.</div>
<div><br>
</div>
<div>But in my opinion requiring MFA for some apps and not others is just added complication to the underlying issue that passwords alone are insufficient for all access.</div>
<div><br>
</div>
<div>I believe it just adds to user confusion and more help desk calls.</div>
<div><br>
</div>
<div>We went from 1k users using MFA to over 30k in 6 weeks. All employees are required to use MFA for all Web apps whether the app is SaaS / SAML or in house CAS.</div>
<div><br>
</div>
<div>But this is a policy decision not a technical one. Policy decisions can create technical complexity.</div>
<div><br>
</div>
<div>I used to work for Novell, the inventor of NetWare (Drew Major) once said “minimal but sufficient” was a guiding motto.</div>
<div><br>
</div>
<div>-B</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt">
<span style="font-weight:bold">From: </span>Michael Grady <<a href="mailto:mgrady@unicon.net">mgrady@unicon.net</a>><br>
<span style="font-weight:bold">Reply-To: </span>"<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>" <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Date: </span>Friday, March 31, 2017 at 3:48 PM<br>
<span style="font-weight:bold">To: </span>"<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>" <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>><br>
<span style="font-weight:bold">Subject: </span>[Ext] Re: Forcing Duo by Service Provider<br>
</div>
<div><br>
</div>
<div>
<div style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<br class="">
<div>
<blockquote type="cite" class="">
<div class="">On Mar 31, 2017, at 4:39 PM, Cantor, Scott <<a href="mailto:cantor.2@osu.edu" class="">cantor.2@osu.edu</a>> wrote:</div>
<br class="Apple-interchange-newline">
<div class="">
<div class="">On 3/31/17, 5:31 PM, "users on behalf of Michael A Grady" <<a href="mailto:users-bounces@shibboleth.net" class="">users-bounces@shibboleth.net</a> on behalf of
<a href="mailto:mgrady@unicon.net" class="">mgrady@unicon.net</a>> wrote:<br class="">
<br class="">
<blockquote type="cite" class="">To ensure you get an "entityID" whether a SAML or CAS service, you need to get it this way currently in a scripted attribute: That<br class="">
reminds me we need to create an issue to ask that resolutionContext.getAttributeRecipientID() is populated for CAS also.<br class="">
</blockquote>
<br class="">
Are you sure it's not? The ResolverAttributes action isn't SAML-specific, and if the relyingPartyId field you referenced accessing is set, that should be copied over into the AttributeRecipientId during normal attribute resolution.<br class="">
<br class="">
If you're talking routine attribute resolution, it should be set for CAS. If you're talking MFA, *you* have to set it for either SAML or CAS, or anything else, it's literally using whatever you tell it to use.<br class="">
<br class="">
-- Scott<br class="">
<br class="">
</div>
</div>
</blockquote>
</div>
<div class=""><br class="">
</div>
We had an email chain back in mid-February on this, where it was noted that Marvin wasn't populating resolution context for CAS, and to create an Issue for that. Which I just (finally) did. From back in mid-February:
<div class=""><br class="">
</div>
<div class="">
<div dir="ltr" class="">On Tue, Feb 14, 2017 at 2:29 PM Cantor, Scott <<a href="mailto:cantor.2@osu.edu" class="">cantor.2@osu.edu</a>> wrote:<br class="">
</div>
<blockquote class="gmail_quote" style="margin: 0px 0px 0px 0.8ex; border-left-width: 1px; border-left-color: rgb(204, 204, 204); border-left-style: solid; padding-left: 1ex;">
That's probably something Marvin could fix depending on how/when it's invoking it. Josh's workaround is the same place the SAML flows populate the resolution context from.<br class="gmail_msg">
</blockquote>
<div class=""><br class="">
</div>
<div class="">Yes, should be straightforward. File an issue and I'll attempt to make it work like the SAML flows.</div>
<div class=""><br class="">
</div>
<div class="">Best,</div>
<div class="">Marvin</div>
<div class=""><br class="">
</div>
<div class="">
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;">
--<br class="">
Michael A. Grady<br class="">
IAM Architect, Unicon, Inc.</div>
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">
<br class="">
</div>
<br class="Apple-interchange-newline">
</div>
<br class="">
</div>
</div>
</div>
</span>
</body>
</html>