<div dir="ltr"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small">Thanks! That certainly helped and has exposed another gap in my knowledge. How did you define <span style="font-size:12.8px;font-family:arial,sans-serif">MFASAML2Principal?</span></div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><font face="arial, helvetica, sans-serif"><br>Brian Moon<br><font size="1">Senior System Administrator, Enterprise Systems</font></font></div><div dir="ltr"><font size="1"><span style="color:rgb(0,0,0);font-family:arial,sans,sans-serif;white-space:pre-wrap">Elections & Bylaws Committee Co-Chair, Staff Senate 2017-2018</span><font face="arial, helvetica, sans-serif"><br>Santa Clara University<br><a href="mailto:bmoon@scu.edu" target="_blank">bmoon@scu.edu</a> | <a href="tel:4085544830" target="_blank">(408) 554-4830</a></font></font><br></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>
<br><div class="gmail_quote">On Wed, Aug 9, 2017 at 3:52 PM, Andrew Morgan <span dir="ltr"><<a href="mailto:morgan@orst.edu" target="_blank">morgan@orst.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">On Wed, 9 Aug 2017, Brian Moon wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hello all,<br>
<br>
I have a need to require MFA for a subset of our SPs, whether the SP<br>
requests it or not. To set this up, I have the IdP configured the MFA flow<br>
to programmatically select the flows, wherein the script looks at the<br>
requesting party and makes a determination from that on whether to require<br>
a second factor or not. The issue I'm running into, though, is that the<br>
result from the previous execution is being used rather than re-evaluating<br>
each time. Following the documentation at<br>
<a href="https://wiki.shibboleth.net/confluence/display/IDP30/MultiFactorAuthnConfiguration#MultiFactorAuthnConfiguration-ReuseoftheEntireauthn/MFAFlowResult(WhenIsaMFANextFlowStrategyExecuted?)" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/co<wbr>nfluence/display/IDP30/MultiFa<wbr>ctorAuthnConfiguration#MultiFa<wbr>ctorAuthnConfiguration-Reuseof<wbr>theEntireauthn/MFAFlowResult(W<wbr>henIsaMFANextFlowStrategyExecu<wbr>ted?)</a>,<br>
I have added the following to relying-party.xml:<br>
<br>
<bean id="MfaPrincipal" parent="shibboleth.SAML2AuthnC<wbr>ontextClassRef"<br>
c:classRef="<a href="https://refeds.org/profile/mfa" rel="noreferrer" target="_blank">https://refeds.or<wbr>g/profile/mfa</a>" /><br>
<br>
<bean id="PasswordPrincipal"<br>
parent="shibboleth.SAML2AuthnC<wbr>ontextClassRef"<br>
<br>
c:classRef="urn:oasis:names:tc<wbr>:SAML:2.0:ac:classes:PasswordP<wbr>rotectedTransport"<br>
/><br>
<br>
<util:list id="shibboleth.RelyingPartyOve<wbr>rrides"><br>
<bean parent="RelyingPartyByName" c:relyingPartyIds="<br>
<a href="https://example/sp" rel="noreferrer" target="_blank">https://example/sp</a>"><br>
<property name="profileConfigurations"><br>
<list><br>
<bean parent="SAML2.SSO"<br>
p:disallowedFeatures-ref="SAML<wbr>2.SSO.FEATURE_AUTHNCONTEXT"><br>
<property name="defaultAuthenticationMet<wbr>hods"><br>
<list><br>
<ref bean="MfaPrincipal" /><br>
<ref bean="PasswordPrincipal" /><br>
</list><br>
</property><br>
</bean><br>
<ref bean="SAML2.Logout" /><br>
</list><br>
</property><br>
</bean><br>
</util:list><br>
</blockquote>
<br></div></div>
Don't put PasswordPrincipal in the defaultAuthenticationMethods list. Here is my code:<br>
<br>
<bean parent="RelyingPartyByName" c:relyingPartyIds="<a href="http://people.oregonstate.edu/~morgan/simplesaml/module.php/saml/sp/metadata.php/default-sp" rel="noreferrer" target="_blank">http://peop<wbr>le.oregonstate.edu/~morgan/<wbr>simplesaml/module.php/saml/sp/<wbr>metadata.php/default-sp</a>"><br>
<property name="profileConfigurations"><br>
<list><br>
<bean parent="SAML2.SSO" p:disallowedFeatures-ref="SAML<wbr>2.SSO.FEATURE_AUTHNCONTEXT" p:securityConfiguration-ref="S<wbr>HA1SecurityConfig"><br>
<property name="defaultAuthenticationMet<wbr>hods"><br>
<list><br>
<ref bean="MFASAML2Principal" /><br>
</list><br>
</property><br>
</bean><br>
</list><br>
</property><br>
</bean><br>
<br>
If you include PasswordPrincipal, then that is an acceptable method of authentication too.<br>
<br>
Andy<span class="HOEnZb"><font color="#888888"><br>
-- <br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.n<wbr>et</a><br>
</font></span></blockquote></div><br></div>