<div dir="ltr"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small">Looks like they might, but cannot say for sure since it's still bombing with the following:</div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small"><div class="gmail_default">2017-08-09 16:32:11,494 - DEBUG [net.shibboleth.idp.saml.profile.impl.InitializeAuthenticationContext:115] - Profile Action InitializeAuthenticationContext: Created authentication context: AuthenticationContext{initiationInstant=2017-08-09T16:32:11.494-07:00, isPassive=false, forceAuthn=false, hintedName=null, potentialFlows=[], activeResults=[], attemptedFlow=null, signaledFlowId=null, authenticationStateMap={}, resultCacheable=true, initialAuthenticationResult=null, authenticationResult=null, completionInstant=1969-12-31T16:00:00.000-08:00}</div><div class="gmail_default">2017-08-09 16:32:11,494 - DEBUG [net.shibboleth.idp.saml.saml2.profile.impl.ProcessRequestedAuthnContext:174] - Profile Action ProcessRequestedAuthnContext: AuthnRequest did not contain a RequestedAuthnContext, nothing to do</div><div class="gmail_default">2017-08-09 16:32:11,495 - DEBUG [net.shibboleth.idp.authn.impl.PopulateAuthenticationContext:200] - Profile Action PopulateAuthenticationContext: Installed 1 potential authentication flows into AuthenticationContext</div><div class="gmail_default">2017-08-09 16:32:11,495 - DEBUG [net.shibboleth.idp.session.impl.StorageBackedSessionManager:798] - Performing primary lookup on session ID 7c7d1729659cd20b4aa865fe4a751b4de4fa20ea1e0a6773874da4aeabfdf68b</div><div class="gmail_default">2017-08-09 16:32:11,496 - DEBUG [net.shibboleth.idp.session.impl.StorageBackedIdPSession:90] - Updating expiration of master record for session 7c7d1729659cd20b4aa865fe4a751b4de4fa20ea1e0a6773874da4aeabfdf68b to 2017-08-09T17:32:11.496-07:00</div><div class="gmail_default">2017-08-09 16:32:11,497 - DEBUG [net.shibboleth.idp.session.impl.StorageBackedIdPSession:536] - Loading AuthenticationResult for flow authn/MFA in session 7c7d1729659cd20b4aa865fe4a751b4de4fa20ea1e0a6773874da4aeabfdf68b</div><div class="gmail_default">2017-08-09 16:32:11,505 - DEBUG [net.shibboleth.idp.session.impl.ExtractActiveAuthenticationResults:124] - Profile Action ExtractActiveAuthenticationResults: Authentication result authn/MFA is active, copying from session</div><div class="gmail_default">2017-08-09 16:32:11,506 - DEBUG [net.shibboleth.idp.authn.impl.InitializeRequestedPrincipalContext:163] - Profile Action InitializeRequestedPrincipalContext: Established RequestedPrincipalContext with 1 methods</div><div class="gmail_default">2017-08-09 16:32:11,507 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByForcedAuthn:53] - Profile Action FilterFlowsByForcedAuthn: Request does not have forced authentication requirement, nothing to do</div><div class="gmail_default">2017-08-09 16:32:11,507 - DEBUG [net.shibboleth.idp.authn.impl.FilterFlowsByNonBrowserSupport:53] - Profile Action FilterFlowsByNonBrowserSupport: Request does not have non-browser requirement, nothing to do</div><div class="gmail_default">2017-08-09 16:32:11,508 - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:370] - Profile Action SelectAuthenticationFlow: Specific principals requested with 'exact' operator: [AuthnContextClassRefPrincipal{authnContextClassRef=<a href="http://id.incommon.org/assurance/mfa">http://id.incommon.org/assurance/mfa</a>}]</div><div class="gmail_default">2017-08-09 16:32:11,509 - DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:477] - Profile Action SelectAuthenticationFlow: Checking for an inactive flow or active result compatible with operator 'exact' and principal '<a href="http://id.incommon.org/assurance/mfa">http://id.incommon.org/assurance/mfa</a>'</div><div class="gmail_default">2017-08-09 16:32:11,510 - DEBUG [net.shibboleth.idp.authn.principal.PrincipalEvalPredicateFactoryRegistry:82] - Registry located predicate factory of type 'net.shibboleth.idp.authn.principal.impl.ExactPrincipalEvalPredicateFactory' for principal type 'class net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal' and operator 'exact'</div><div class="gmail_default">2017-08-09 16:32:11,512 - INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:508] - Profile Action SelectAuthenticationFlow: None of the potential authentication flows can satisfy the request</div><div class="gmail_default">2017-08-09 16:32:11,513 - WARN [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event occurred while processing the request: RequestUnsupported</div><div class="gmail_default"><br></div><div class="gmail_default">I get the same thing with the REFEDS value. From this I just found a thread at <a href="http://shibboleth.1660669.n2.nabble.com/Forcing-Duo-by-Service-Provider-td7632287.html">http://shibboleth.1660669.n2.nabble.com/Forcing-Duo-by-Service-Provider-td7632287.html</a>, which is exactly what I want to do. I'll keep digging into that thread and let you know if I find anything with REFEDS.</div></div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><font face="arial, helvetica, sans-serif"><br>Brian Moon<br><font size="1">Senior System Administrator, Enterprise Systems</font></font></div><div dir="ltr"><font size="1"><span style="color:rgb(0,0,0);font-family:arial,sans,sans-serif;white-space:pre-wrap">Elections & Bylaws Committee Co-Chair, Staff Senate 2017-2018</span><font face="arial, helvetica, sans-serif"><br>Santa Clara University<br><a href="mailto:bmoon@scu.edu" target="_blank">bmoon@scu.edu</a> | <a href="tel:4085544830" target="_blank">(408) 554-4830</a></font></font><br></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div>
<br><div class="gmail_quote">On Wed, Aug 9, 2017 at 4:24 PM, Andrew Morgan <span dir="ltr"><<a href="mailto:morgan@orst.edu" target="_blank">morgan@orst.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On Wed, 9 Aug 2017, Brian Moon wrote:<br>
<br>
</span><span class=""><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Thanks! That certainly helped and has exposed another gap in my knowledge. How did you define MFASAML2Principal?<br>
</blockquote>
<br></span>
In relying-party.xml, I have:<br>
<br>
<bean id="MFASAML2Principal" parent="shibboleth.SAML2AuthnC<wbr>ontextClassRef" c:classRef="<a href="http://id.incommon.org/assurance/mfa" rel="noreferrer" target="_blank">http://id.incommon<wbr>.org/assurance/mfa</a>" /><br>
<br>
Does REFEDS have a class now? If so, I could use that before we go live next week... :)<div class="HOEnZb"><div class="h5"><br>
<br>
Andy<br>
-- <br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.n<wbr>et</a><br>
</div></div></blockquote></div><br></div>