<div dir="ltr">Hi,<br><br>We are using MFA flow. The SP requests MFA to the IDP sending on the request with the 'exact' operator and the principal '<a href="http://id.incommon.org/assurance/mfa">http://id.incommon.org/assurance/mfa</a>'.<br>We added supportedPrincipals in general-auth.xml:<br><br><bean id="authn/MFA" parent="shibboleth.AuthenticationFlow"<br>                p:passiveAuthenticationSupported="true"<br>                p:forcedAuthenticationSupported="true"><br>            <property name="supportedPrincipals"><br>                <list><br>                    <bean parent="shibboleth.SAML2AuthnContextClassRef"<br>                        c:classRef="<a href="http://id.incommon.org/assurance/mfa">http://id.incommon.org/assurance/mfa</a>" /><br>                    <bean parent="shibboleth.SAML2AuthnContextClassRef"<br>                        c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" />                   <br>                    <bean parent="shibboleth.SAML2AuthnContextClassRef"<br>                        c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:Password" /><br>                    <bean parent="shibboleth.SAML1AuthenticationMethod"<br>                        c:method="urn:oasis:names:tc:SAML:1.0:am:password" /><br>                    <bean parent="shibboleth.SAML2AuthnContextClassRef"<br>                        c:classRef="urn:oasis:names:tc:SAML:2.0:assertion" /><br>                </list><br>            </property><br>        </bean><br><br>The first flow  and second flow  are executed, the MFA flow is completed successfully, but the response we have is:<br>"Authentication result for auth flow/MFA did not satisfy the request"<br>How to configure the MFA Authentication result to respond according to the request ('<a href="http://id.incommon.org/assurance/mfa">http://id.incommon.org/assurance/mfa</a>') ?<br><br>Logs: <br><br><br>2017-12-01 18:38:56,056 - DEBUG [net.shibboleth.idp.authn.impl.FinalizeMultiFactorAuthentication:193] - Profile Action FinalizeMultiFactorAuthentication: MFA complete, pr<br>oducing merged result<br>2017-12-01 18:38:56,094 - DEBUG [net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext:79] - Profile Action PopulateSubjectCanonicalizationContext: Install<br>ing 2 canonicalization flows into SubjectCanonicalizationContext<br>2017-12-01 18:38:56,095 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] - Profile Action SelectSubjectCanonicalizationFlow: Checking canonic<br>alization flow c14n/x500 for applicability...<br>2017-12-01 18:38:56,096 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:106] - Profile Action SelectSubjectCanonicalizationFlow: Canonicalization<br> flow c14n/x500 was not applicable to this request<br>2017-12-01 18:38:56,096 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] - Profile Action SelectSubjectCanonicalizationFlow: Checking canonic<br>alization flow c14n/simple for applicability...<br>2017-12-01 18:38:56,096 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:83] - Profile Action SelectSubjectCanonicalizationFlow: Selecting canonic<br>alization flow c14n/simple<br>2017-12-01 18:38:56,097 - DEBUG [net.shibboleth.idp.authn.AbstractSubjectCanonicalizationAction:226] - Profile Action SimpleSubjectCanonicalization: trimming whitespace o<br>f input string 'aluno'<br>2017-12-01 18:38:56,155 - DEBUG [net.shibboleth.idp.session.impl.DetectIdentitySwitch:148] - Profile Action DetectIdentitySwitch: No previous session found, nothing to do<br>2017-12-01 18:38:56,200 - DEBUG [net.shibboleth.idp.authn.impl.FinalizeAuthentication:137] - Profile Action FinalizeAuthentication: Canonical principal name was establish<br>ed as 'aluno'<br>2017-12-01 18:38:56,204 - DEBUG [net.shibboleth.idp.authn.impl.FinalizeAuthentication:242] - Profile Action FinalizeAuthentication: Checking result for compatibility with<br> operator 'exact' and principal '<a href="http://id.incommon.org/assurance/mfa">http://id.incommon.org/assurance/mfa</a>'<br>2017-12-01 18:38:56,205 - DEBUG [net.shibboleth.idp.authn.principal.PrincipalEvalPredicateFactoryRegistry:82] - Registry located predicate factory of type 'net.shibboleth<br>.idp.authn.principal.impl.ExactPrincipalEvalPredicateFactory' for principal type 'class net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal' and operato<br>r 'exact'<br>2017-12-01 18:38:56,206 - WARN [net.shibboleth.idp.authn.impl.FinalizeAuthentication:179] - Profile Action FinalizeAuthentication: Authentication result for flow authn/MF<br>A did not satisfy the request<br>2017-12-01 18:38:56,236 - WARN [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event occurred while processing the request: RequestUnsupported<br></div>