<div dir="ltr">Thanks Lee, I like the idea of using a group for the CAS/MFA service. I may try to use that.<div><br></div><div>The part I don't get from your example (and it's definitely my lack understanding) ... where is that you are forcing DUO for those Banner/Cas services?</div><div><br></div><div>Also do you have more than one authentication type enabled? I only have MFA enabled. I was specifying the MFA authentication in the relyingparty config file also but took it out when I realized that to do OPT in for Duo on everything I was going to have to send everything to the MFA flow. Your suggestion might work for me (or at least part of it) .... I will have to think it through and test it out.</div><div><br></div><div>Thanks for your input!</div></div><div class="gmail_extra"><br clear="all"><div><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div><div></div><div><br></div><div>Brad Mathis</div><div>Principal Systems Analyst</div><div>Pima Community College</div><div>IT - Technical Services</div><div>520.206.4826</div><div><a href="mailto:bmathis@pima.edu" target="_blank">bmathis@pima.edu</a></div></div><div><br></div><div><img src="https://docs.google.com/a/pima.edu/uc?id=0B4QEFWYNTFJATTZySzROc0JISEk&export=download" width="200" height="150"><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div></div></div></div></div></div></div></div></div></div>
<br><div class="gmail_quote">On Mon, Feb 5, 2018 at 1:34 PM, Lee Foltz <span dir="ltr"><<a href="mailto:foltz2@oakland.edu" target="_blank">foltz2@oakland.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Brad, <div>We did the following for Banner 9 services.</div><div><br></div><div>We created this entry in relying party. Then all we do is add the CAS services we want to use MFA in cas-protocol.xml to the mfa-services p:group="mfa-<wbr>services"</div><div><br></div><div><div> <bean parent="RelyingPartyByGroup" c:groupNames="mfa-services"></div><div> <property name="profileConfigurations"></div><div> <list></div><div> <bean parent="CAS.<wbr>LoginConfiguration"></div><div> <property name="<wbr>defaultAuthenticationMethods"></div><div> <list></div><div> <bean parent="shibboleth.<wbr>SAML2AuthnContextClassRef"</div><div> c:classRef="<a href="http://id.incommon.org/assurance/mfa" target="_blank">http://id.<wbr>incommon.org/assurance/mfa</a>" /></div><div> <!--<bean parent="shibboleth.<wbr>SAML2AuthnContextClassRef"</div><div> c:classRef="urn:oasis:names:<wbr>tc:SAML:2.0:ac:classes:<wbr>PasswordProtectedTransport" />--></div><div> </list></div><div> </property></div><div> </bean></div><div> <bean parent="CAS.<wbr>ProxyConfiguration" /></div><div> <bean parent="CAS.<wbr>ValidateConfiguration" /></div><div> </list></div><div> </property></div><div> </bean></div></div><div><br></div><div>Then in cas-protocol.xml we did this</div><div><br></div><div><div><!-- Banner Application Navigator --></div><div> <bean class="net.shibboleth.idp.cas.<wbr>service.ServiceDefinition"</div><div> c:regex="<a href="https://somebox.name">https://somebox.name</a>.<wbr>edu:8443(/.*)?"</div><div> p:group="mfa-services"</div><div> p:authorizedToProxy="true"</div><div> p:singleLogoutParticipant="<wbr>true" /></div></div><div><br></div><div>All our other CAS services are just "authn/Password", but if we add them to this p:group it uses authn/DUO after authn/Password.</div><div>One nice feature is since the cas file reloads every 15 minutes, we don't have to restart service to add a new MFA service.</div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, Feb 5, 2018 at 1:57 PM, Mathis, Bradley <span dir="ltr"><<a href="mailto:bmathis@pima.edu" target="_blank">bmathis@pima.edu</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>Howdy all,</div><div><div><br></div><div>I'm successfully using mfa logic to send specific users to Duo Authentication, thanks to the samples/documentation/wiki and postings from users here on <a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a> </div><div>I'm now adding another piece of mfa logic to the mfa-authn-config.xml checksecondfactore inline script.</div><div><br></div><div>Prior to checking for specific user attributes I'm now first checking the RelyingPartyId to see if Duo is needed. I'm able to do this successfully after stealing some example logic that Andrew Morgan posted ..Thanks Andrew!</div><div><br></div><div><br></div><div>This is an excerpt from my mfa-authn-config.xml</div><div><br></div><div> rpid = profileContext.getSubcontext("<wbr>net.shibboleth.idp.profile.con<wbr>text.RelyingPartyContext").get<wbr>RelyingPartyId();</div><div> if (rpid.equals("<a href="https://banner-temp.pima.edu/applicationNavigator/j_spring_cas_security_check" target="_blank">https://banner-t<wbr>emp.pima.edu/applicationNaviga<wbr>tor/j_spring_cas_security_<wbr>check</a>")) {</div><div> nextFlow = "authn/Duo";</div><div> }</div><div><br></div><div><br></div><div>The above works if I add an if statement for every RelyingPartyId separately. I was hoping I might be able to use a regular expression and do a pattern match or something like that (my terminology is probably wrong). I'm not a programmer.</div><div><br></div><div><br></div><div>e.g. </div><div><br></div><div>Let's say I have multiple RelyingPartyIds like this</div><div><br></div><div><span class="m_1727510520523498282m_-1166827192006428108gmail-Apple-tab-span" style="white-space:pre-wrap"> </span><a href="https://banner-temp.pima.edu/applicationNavigator/j_spring_cas_security_check" target="_blank">https://banner-temp.pima.edu/a<wbr>pplicationNavigator/j_spring_c<wbr>as_security_check</a></div><div><span class="m_1727510520523498282m_-1166827192006428108gmail-Apple-tab-span" style="white-space:pre-wrap"> </span><a href="https://banner-dev.pima.edu/applicationNavigator/j_spring_cas_security_check" target="_blank">https://banner-dev.pima.edu/ap<wbr>plicationNavigator/j_spring_ca<wbr>s_security_check</a></div><div><span class="m_1727510520523498282m_-1166827192006428108gmail-Apple-tab-span" style="white-space:pre-wrap"> </span><a href="https://banner-test.pima.edu/applicationNavigator/j_spring_cas_security_check" target="_blank">https://banner-test.pima.edu/a<wbr>pplicationNavigator/j_spring_c<wbr>as_security_check</a></div><div><span class="m_1727510520523498282m_-1166827192006428108gmail-Apple-tab-span" style="white-space:pre-wrap"> </span><a href="https://banner-prod.pima.edu/applicationNavigator/j_spring_cas_security_check" target="_blank">https://banner-prod.pima.edu/a<wbr>pplicationNavigator/j_spring_c<wbr>as_security_check</a></div><div><span class="m_1727510520523498282m_-1166827192006428108gmail-Apple-tab-span" style="white-space:pre-wrap"> </span></div><div>rather than creating an if statement for each one I would like to do a pattern match up against something like this</div><div><br></div><div>(https:\/\/.+(<a href="http://pima.edu" target="_blank">pima.edu</a>\/applic<wbr>ationNavigator\/j_spring_cas_<wbr>security_check)\/?.*)</div><div><br></div><div><br></div><div>and if it's true then set the nextFlow = "authn/Duo"</div><div><br></div><div><br></div><div>Anyone one have a sample I can hack at? If not no worries I'm very happy with my success so far and can probably live with adding each one separately. </div><div><br></div><div><br></div><div>Thanks!</div></div><div><br></div><div><br></div><br clear="all"><div><div class="m_1727510520523498282m_-1166827192006428108gmail_signature"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div><div></div><div><br></div><div>Brad Mathis</div><div>Principal Systems Analyst</div><div>Pima Community College</div><div>IT - Technical Services</div><div><a href="tel:(520)%20206-4826" value="+15202064826" target="_blank">520.206.4826</a></div><div><a href="mailto:bmathis@pima.edu" target="_blank">bmathis@pima.edu</a></div></div><div><br></div><div><img src="https://docs.google.com/a/pima.edu/uc?id=0B4QEFWYNTFJATTZySzROc0JISEk&export=download" width="200" height="150"><br></div><div><br></div><div><br></div><div><br></div><div><br></div><div><br></div></div></div></div></div></div></div></div></div></div><span class="HOEnZb"><font color="#888888">
</font></span></div><span class="HOEnZb"><font color="#888888">
<br>--<br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/co<wbr>nfluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.n<wbr>et</a><br></font></span></blockquote></div><span class="HOEnZb"><font color="#888888"><br><br clear="all"><div><br></div>-- <br><div class="m_1727510520523498282gmail_signature" data-smartmail="gmail_signature"><div>Lee Foltz</div><div>Oakland University - UTS</div><div>Senior Identity Systems Engineer</div><div> </div><div><a href="tel:(248)%20370-2675" value="+12483702675" target="_blank">248-370-2675</a></div></div>
</font></span></div>
<br>--<br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/<wbr>confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br></blockquote></div><br></div>