<div dir="ltr"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small">Seems I had to take it one step further and add the principals to the authn/MFA flow as well. But once I did that, it started working like a charm.</div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small">Thanks!</div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><font face="arial, helvetica, sans-serif"><br>Brian Moon<br><font size="1">Senior System Administrator, Enterprise Systems</font></font></div><div dir="ltr"><font size="1"><span style="color:rgb(0,0,0);font-family:arial,sans,sans-serif;white-space:pre-wrap">Elections & Bylaws Committee Co-Chair, Staff Senate 2017-2018</span><font face="arial, helvetica, sans-serif"><br>Santa Clara University<br><a href="mailto:bmoon@scu.edu" target="_blank">bmoon@scu.edu</a> | <a href="tel:4085544830" target="_blank">(408) 554-4830</a></font></font><br></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>
<br><div class="gmail_quote">On Wed, Aug 9, 2017 at 4:59 PM, Andrew Morgan <span dir="ltr"><<a href="mailto:morgan@orst.edu" target="_blank">morgan@orst.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On Wed, 9 Aug 2017, Brian Moon wrote:<br>
<br>
</span><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">
Looks like they might, but cannot say for sure since it's still bombing<br>
with the following:<br>
<br></span><span class="">
2017-08-09 16:32:11,512 - INFO<br>
[net.shibboleth.idp.authn.impl<wbr>.SelectAuthenticationFlow:508] - Profile<br>
Action SelectAuthenticationFlow: None of the potential authentication flows<br>
can satisfy the request<br>
2017-08-09 16:32:11,513 - WARN<br>
[org.opensaml.profile.action.i<wbr>mpl.LogEvent:105] - A non-proceed event<br>
occurred while processing the request: RequestUnsupported<br>
<br>
I get the same thing with the REFEDS value. From this I just found a<br>
thread at<br>
<a href="http://shibboleth.1660669.n2.nabble.com/Forcing-Duo-by-Service-Provider-td7632287.html" rel="noreferrer" target="_blank">http://shibboleth.1660669.n2.n<wbr>abble.com/Forcing-Duo-by-Servi<wbr>ce-Provider-td7632287.html</a>,<br>
which is exactly what I want to do. I'll keep digging into that thread and<br>
let you know if I find anything with REFEDS.<br>
</span></blockquote>
<br>
That's my thread... :)<br>
<br>
Did you configure the rest of Shibboleth to support Duo? You need to modify conf/authn/general-authn.xml (make the classRef match incommon or refeds or whatever you use):<br>
<br>
<bean id="authn/Duo" parent="shibboleth.Authenticat<wbr>ionFlow"<br>
p:forcedAuthenticationSupporte<wbr>d="true"<br>
p:nonBrowserSupported="false"><br>
<!--<br>
The list below should be changed to reflect whatever locally- or<br>
community-defined values are appropriate to represent MFA. It is<br>
strongly advised that the value not be specific to Duo or any<br>
particular technology.<br>
--><br>
<property name="supportedPrincipals"><br>
<list><br>
<bean parent="shibboleth.SAML2AuthnC<wbr>ontextClassRef"<span class=""><br>
c:classRef="<a href="http://id.incommon.org/assurance/mfa" rel="noreferrer" target="_blank">http://id.incommon<wbr>.org/assurance/mfa</a>" /><br></span>
<bean parent="shibboleth.SAML1Authen<wbr>ticationMethod"<br>
c:method="<a href="http://example.org/ac/classes/mfa" rel="noreferrer" target="_blank">http://example.org/a<wbr>c/classes/mfa</a>" /><br>
</list><br>
</property><br>
</bean><br>
<br>
<br>
You also need to check your logic in conf/authn/mfa-authn-config.xm<wbr>l, of course. But your error suggests it can't find a supported principal for your authenticationContextClassRef.<wbr>...<div class="HOEnZb"><div class="h5"><br>
<br>
Andy<br>
-- <br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.n<wbr>et</a><br>
</div></div></blockquote></div><br></div>