<div dir="auto"><div dir="auto">Thanks Andy.</div><div dir="auto"><br></div><div dir="auto">Yes, I have configured, but I'm not using duo. I'm using my own developed autentication flow.<br></div><div dir="auto">Is there any other needed configration to set the MFA authentication result with "<a href="http://id.incommon.org/assurance/mfa">http://id.incommon.org/assurance/mfa</a>"?</div></div><div class="gmail_extra"><br><div class="gmail_quote">Em 1 de dez de 2017 9:15 PM, "Andrew Morgan" <<a href="mailto:morgan@orst.edu" target="_blank">morgan@orst.edu</a>> escreveu:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Did you configure the "authn/Duo" bean supportedPrincipals? Here is mine:<br>
<br>
<bean id="authn/Duo" parent="shibboleth.Authenticat<wbr>ionFlow"<br>
p:forcedAuthenticationSupporte<wbr>d="true"<br>
p:nonBrowserSupported="false"><br>
<property name="supportedPrincipals"><br>
<list><br>
<bean parent="shibboleth.SAML2AuthnC<wbr>ontextClassRef"<br>
c:classRef="<a href="https://refeds.org/profile/mfa" rel="noreferrer" target="_blank">https://refeds.org<wbr>/profile/mfa</a>" /><br>
</list><br>
</property><br>
</bean><br>
<br>
Note: We use the "<a href="https://refeds.org/profile/mfa" rel="noreferrer" target="_blank">https://refeds.org/profile/mf<wbr>a</a>" authnContextClassRef, but you would put "<a href="http://id.incommon.org/assurance/mfa" rel="noreferrer" target="_blank">http://id.incommon.org/assura<wbr>nce/mfa</a>", of course.<br>
<br>
Thanks,<br>
Andy<br>
<br>
On Fri, 1 Dec 2017, Samuel Bristot Loli wrote:<br>
<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi,<br>
<br>
We are using MFA flow. The SP requests MFA to the IDP sending on the<br>
request with the 'exact' operator and the principal '<br>
<a href="http://id.incommon.org/assurance/mfa" rel="noreferrer" target="_blank">http://id.incommon.org/assuran<wbr>ce/mfa</a>'.<br>
We added supportedPrincipals in general-auth.xml:<br>
<br>
<bean id="authn/MFA" parent="shibboleth.Authenticat<wbr>ionFlow"<br>
p:passiveAuthenticationSuppor<wbr>ted="true"<br>
p:forcedAuthenticationSupport<wbr>ed="true"><br>
<property name="supportedPrincipals"><br>
<list><br>
<bean parent="shibboleth.SAML2AuthnC<wbr>ontextClassRef"<br>
c:classRef="<a href="http://id.incommon.org/assurance/mfa" rel="noreferrer" target="_blank">http://id.incommo<wbr>n.org/assurance/mfa</a>" /><br>
<bean parent="shibboleth.SAML2AuthnC<wbr>ontextClassRef"<br>
<br>
c:classRef="urn:oasis:names:tc<wbr>:SAML:2.0:ac:classes:PasswordP<wbr>rotectedTransport"<br>
/><br>
<bean parent="shibboleth.SAML2AuthnC<wbr>ontextClassRef"<br>
<br>
c:classRef="urn:oasis:names:tc<wbr>:SAML:2.0:ac:classes:Password" /><br>
<bean parent="shibboleth.SAML1Authen<wbr>ticationMethod"<br>
c:method="urn:oasis:names:tc:<wbr>SAML:1.0:am:password"<br>
/><br>
<bean parent="shibboleth.SAML2AuthnC<wbr>ontextClassRef"<br>
c:classRef="urn:oasis:names:t<wbr>c:SAML:2.0:assertion"<br>
/><br>
</list><br>
</property><br>
</bean><br>
<br>
The first flow and second flow are executed, the MFA flow is completed<br>
successfully, but the response we have is:<br>
"Authentication result for auth flow/MFA did not satisfy the request"<br>
How to configure the MFA Authentication result to respond according to the<br>
request ('<a href="http://id.incommon.org/assurance/mfa" rel="noreferrer" target="_blank">http://id.incommon.org/assur<wbr>ance/mfa</a>') ?<br>
<br>
Logs:<br>
<br>
<br>
2017-12-01 18:38:56,056 - DEBUG<br>
[net.shibboleth.idp.authn.impl<wbr>.FinalizeMultiFactorAuthentica<wbr>tion:193] -<br>
Profile Action FinalizeMultiFactorAuthenticat<wbr>ion: MFA complete, pr<br>
oducing merged result<br>
2017-12-01 18:38:56,094 - DEBUG<br>
[net.shibboleth.idp.authn.impl<wbr>.PopulateSubjectCanonicalizati<wbr>onContext:79] -<br>
Profile Action PopulateSubjectCanonicalizatio<wbr>nContext: Install<br>
ing 2 canonicalization flows into SubjectCanonicalizationContext<br>
2017-12-01 18:38:56,095 - DEBUG<br>
[net.shibboleth.idp.authn.impl<wbr>.SelectSubjectCanonicalization<wbr>Flow:100] -<br>
Profile Action SelectSubjectCanonicalizationF<wbr>low: Checking canonic<br>
alization flow c14n/x500 for applicability...<br>
2017-12-01 18:38:56,096 - DEBUG<br>
[net.shibboleth.idp.authn.impl<wbr>.SelectSubjectCanonicalization<wbr>Flow:106] -<br>
Profile Action SelectSubjectCanonicalizationF<wbr>low: Canonicalization<br>
flow c14n/x500 was not applicable to this request<br>
2017-12-01 18:38:56,096 - DEBUG<br>
[net.shibboleth.idp.authn.impl<wbr>.SelectSubjectCanonicalization<wbr>Flow:100] -<br>
Profile Action SelectSubjectCanonicalizationF<wbr>low: Checking canonic<br>
alization flow c14n/simple for applicability...<br>
2017-12-01 18:38:56,096 - DEBUG<br>
[net.shibboleth.idp.authn.impl<wbr>.SelectSubjectCanonicalization<wbr>Flow:83] -<br>
Profile Action SelectSubjectCanonicalizationF<wbr>low: Selecting canonic<br>
alization flow c14n/simple<br>
2017-12-01 18:38:56,097 - DEBUG<br>
[net.shibboleth.idp.authn.Abst<wbr>ractSubjectCanonicalizationAct<wbr>ion:226] -<br>
Profile Action SimpleSubjectCanonicalization: trimming whitespace o<br>
f input string 'aluno'<br>
2017-12-01 18:38:56,155 - DEBUG<br>
[<a href="http://net.shibboleth.idp.session.im">net.shibboleth.idp.session.im</a><wbr>pl.DetectIdentitySwitch:148] - Profile Action<br>
DetectIdentitySwitch: No previous session found, nothing to do<br>
2017-12-01 18:38:56,200 - DEBUG<br>
[net.shibboleth.idp.authn.impl<wbr>.FinalizeAuthentication:137] - Profile Action<br>
FinalizeAuthentication: Canonical principal name was establish<br>
ed as 'aluno'<br>
2017-12-01 18:38:56,204 - DEBUG<br>
[net.shibboleth.idp.authn.impl<wbr>.FinalizeAuthentication:242] - Profile Action<br>
FinalizeAuthentication: Checking result for compatibility with<br>
operator 'exact' and principal '<a href="http://id.incommon.org/assurance/mfa" rel="noreferrer" target="_blank">http://id.incommon.org/assura<wbr>nce/mfa</a>'<br>
2017-12-01 18:38:56,205 - DEBUG<br>
[net.shibboleth.idp.authn.prin<wbr>cipal.PrincipalEvalPredicateFa<wbr>ctoryRegistry:82]<br>
- Registry located predicate factory of type 'net.shibboleth<br>
.idp.authn.principal.impl.Exac<wbr>tPrincipalEvalPredicateFactory<wbr>' for principal<br>
type 'class<br>
net.shibboleth.idp.saml.authn.<wbr>principal.AuthnContextClassRef<wbr>Principal' and<br>
operato<br>
r 'exact'<br>
2017-12-01 18:38:56,206 - WARN<br>
[net.shibboleth.idp.authn.impl<wbr>.FinalizeAuthentication:179] - Profile Action<br>
FinalizeAuthentication: Authentication result for flow authn/MF<br>
A did not satisfy the request<br>
2017-12-01 18:38:56,236 - WARN<br>
[org.opensaml.profile.action.i<wbr>mpl.LogEvent:105] - A non-proceed event<br>
occurred while processing the request: RequestUnsupported<br>
<br>
</blockquote>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/co<wbr>nfluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.n<wbr>et</a><br>
</blockquote></div></div>