<div dir="ltr"><div>My questions are at the bottom.</div><div><br></div><div>Background info:</div><div><br></div><div>In a test idp 3.x enviornment. I currently have 3 applications that I can SSO with.</div><div>1. an app that uses the CAS protocol</div><div>2. an app that we use idp initiated SSO</div><div>3. the testshib site (well it was working, today it can't find my metadata)</div><div><br></div><div>I'm testing out MFA with DUO. I have used the following links for reference on how to configure it.</div><div><br></div><div><br></div><div><a href="https://wiki.shibboleth.net/confluence/pages/viewpage.action?pageId=32112643">https://wiki.shibboleth.net/confluence/pages/viewpage.action?pageId=32112643</a></div><div><br></div><div><a href="https://wiki.shibboleth.net/confluence/display/IDP30/MultiFactorAuthnConfiguration">https://wiki.shibboleth.net/confluence/display/IDP30/MultiFactorAuthnConfiguration</a></div><div><a href="goog_870379464"><br></a></div><div><a href="https://wiki.shibboleth.net/confluence/display/IDP30/DuoAuthnConfiguration">https://wiki.shibboleth.net/confluence/display/IDP30/DuoAuthnConfiguration</a></div><div><br></div><div><br></div><div>I can successfully SSO to these SP's, I get authenticated with authn/Password then get sent to DUO and then to my app.</div><div>At the moment I get a second factor (DUO) prompt for everything. I think that's due to how I have the shibboleth.authn.MFA.TransitionMap configured </div><div>see my example.</div><div>+++++++++++++++++++++++++++++++++++++</div><div><util:map id="shibboleth.authn.MFA.TransitionMap"></div><div> <!-- First rule runs the Password login flow. --></div><div> <entry key=""></div><div> <bean parent="shibboleth.authn.MFA.Transition" p:nextFlow="authn/Password" /></div><div> </entry></div><div><br></div><div> <!--</div><div> Second rule runs a function if IPAddress succeeds, to determine whether an additional</div><div> factor is required.</div><div> --></div><div> <entry key="authn/Password"></div><div> <bean parent="shibboleth.authn.MFA.Transition" p:nextFlowStrategy-ref="checkSecondFactor" /></div><div> </entry></div><div><br></div><div> <!-- An implicit final rule will return whatever the final flow returns. --></div><div> </util:map></div><div><br></div><div> <!-- Example script to see if second factor is required. --></div><div> <bean id="checkSecondFactor" parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript"></div><div> <constructor-arg></div><div> <value></div><div> <![CDATA[</div><div> nextFlow = "authn/Duo";</div><div> nextFlow; // pass control to second factor or end with the first</div><div> ]]></div><div> </value></div><div> </constructor-arg></div><div></bean></div><div>++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++</div><div><br></div><div><br></div><div>Eventually we will have about 10 to 15 SP's some will need MFA and some won't. Some will be CAS protocol and some won't (not sure that matters).</div><div><br></div><div><br></div><div><br></div><div>Questions:</div><div><br></div><div>1. Where/how to define the logic of what apps/SP's need a second factor and which ones don't? </div><div><br></div><div><br></div><div>2. Eventually we will want to use some type of opt-in for apps that don't require MFA, we are hoping to be able to do that based on and attruibute we set in ldap is that possible? ( I think it is ) </div><div>2a. Where in the Documentation would I start or what config file to look at for opt-in?</div><div><br></div><div><br></div><div>Thank You Everyone!</div><div><div class="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div><div></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div>Brad Mathis</div><div>Principal Systems Analyst</div><div>Pima Community College</div><div>IT - Technical Services</div><div>520.206.4826</div><div><a href="mailto:bmathis@pima.edu" target="_blank">bmathis@pima.edu</a></div></div><div><br></div><div><img src="https://docs.google.com/a/pima.edu/uc?id=0B4QEFWYNTFJATTZySzROc0JISEk&export=download" width="200" height="150"><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div></div></div></div></div></div></div></div></div></div>
</div>