<div dir="ltr"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small">Hello all,</div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small">I have a need to require MFA for a subset of our SPs, whether the SP requests it or not.  To set this up, I have the IdP configured the MFA flow to programmatically select the flows, wherein the script looks at the requesting party and makes a determination from that on whether to require a second factor or not.  The issue I'm running into, though, is that the result from the previous execution is being used rather than re-evaluating each time.  Following the documentation at <a href="https://wiki.shibboleth.net/confluence/display/IDP30/MultiFactorAuthnConfiguration#MultiFactorAuthnConfiguration-ReuseoftheEntireauthn/MFAFlowResult(WhenIsaMFANextFlowStrategyExecuted?)">https://wiki.shibboleth.net/confluence/display/IDP30/MultiFactorAuthnConfiguration#MultiFactorAuthnConfiguration-ReuseoftheEntireauthn/MFAFlowResult(WhenIsaMFANextFlowStrategyExecuted?)</a>, I have added the following to relying-party.xml:</div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small"><br></div><div class="gmail_default"><div class="gmail_default"><span style="font-family:arial,helvetica,sans-serif">    <bean id="MfaPrincipal" parent="shibboleth.SAML2AuthnContextClassRef"</span><br></div><div class="gmail_default"><font face="arial, helvetica, sans-serif">        c:classRef="<a href="https://refeds.org/profile/mfa">https://refeds.org/profile/mfa</a>" /></font></div><div class="gmail_default"><font face="arial, helvetica, sans-serif"><br></font></div><div class="gmail_default"><font face="arial, helvetica, sans-serif">    <bean id="PasswordPrincipal" parent="shibboleth.SAML2AuthnContextClassRef"</font></div><div class="gmail_default"><font face="arial, helvetica, sans-serif">        c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" /></font></div><div class="gmail_default"><font face="arial, helvetica, sans-serif"><br></font></div><div class="gmail_default"><font face="arial, helvetica, sans-serif">    <util:list id="shibboleth.RelyingPartyOverrides"></font></div><div class="gmail_default"><font face="arial, helvetica, sans-serif">        <bean parent="RelyingPartyByName" c:relyingPartyIds="<a href="https://example/sp">https://example/sp</a>"></font></div><div class="gmail_default"><font face="arial, helvetica, sans-serif">            <property name="profileConfigurations"></font></div><div class="gmail_default"><font face="arial, helvetica, sans-serif">                <list></font></div><div class="gmail_default"><font face="arial, helvetica, sans-serif">                    <bean parent="SAML2.SSO" p:disallowedFeatures-ref="SAML2.SSO.FEATURE_AUTHNCONTEXT"></font></div><div class="gmail_default"><font face="arial, helvetica, sans-serif">                        <property name="defaultAuthenticationMethods"></font></div><div class="gmail_default"><font face="arial, helvetica, sans-serif">                            <list></font></div><div class="gmail_default"><font face="arial, helvetica, sans-serif">                                <ref bean="MfaPrincipal" /></font></div><div class="gmail_default"><font face="arial, helvetica, sans-serif">                                <ref bean="PasswordPrincipal" /></font></div><div class="gmail_default"><font face="arial, helvetica, sans-serif">                            </list></font></div><div class="gmail_default"><font face="arial, helvetica, sans-serif">                        </property></font></div><div class="gmail_default"><font face="arial, helvetica, sans-serif">                    </bean></font></div><div class="gmail_default"><font face="arial, helvetica, sans-serif">                    <ref bean="SAML2.Logout" /></font></div><div class="gmail_default"><font face="arial, helvetica, sans-serif">                </list></font></div><div class="gmail_default"><font face="arial, helvetica, sans-serif">            </property></font></div><div class="gmail_default"><font face="arial, helvetica, sans-serif">        </bean></font></div><div class="gmail_default"><font face="arial, helvetica, sans-serif">    </util:list></font></div><div class="gmail_default"><br></div><div class="gmail_default">I have also explicitly set idp.authn.favorSSO to false in idp.properties.  I'm not sure if it makes a difference here, but I have idp.authn.flows set to "MFA" (I also tried setting it to "Password|MFA", but that did not seem to help).</div><div class="gmail_default"><br></div><div class="gmail_default">So, I have two questions:</div><div class="gmail_default"><ol><li>Am I going about this the proper way, or is there a better way for the IdP to require MFA on some SPs, but not all?</li><li>If this is the best way to approach this, what else should I be looking at to force it to re-run the script?</li></ol>Thanks!</div></div><div><div class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><font face="arial, helvetica, sans-serif"><br>Brian Moon<br></font></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>
</div>