<div dir="ltr">Noriyuki,<div><br></div><div>The login process didn't result in a principal that could satisfy the AuthnRequest.  Without a successfully authenticated user, the IdP has to return an error to the SP.</div><div><br></div><div>You want to compare the AuthnContext requested in the AuthnRequest, SP metadata, and relying party configuration to the AuthnContexts that resulted from the MFA process.  There might have been no result from authentication at all, or the resulting principal types might not match, so they can't be used.</div><div><br></div><div>

<div style="color:rgb(34,34,34);font-family:arial,sans-serif;font-size:small;font-style:normal;font-variant-ligatures:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration-style:initial;text-decoration-color:initial">There will be something helpful in the logs.</div><br class="gmail-Apple-interchange-newline">

I hope this helps,</div><div>Nate.</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mon, May 14, 2018 at 4:18 PM, Noriyuki TAKEI <span dir="ltr"><<a href="mailto:ntakei@sios.com" target="_blank">ntakei@sios.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hi,all<div><br></div><div>I'm using MultiFactorAuthnConfiguration in Shibboleth 3.3.2.</div><div><br></div><div>But error as below occurred when accessing the sp.</div><div><br></div><div><div><saml2p:Status></div><div>    <saml2p:StatusCode Value="urn:oasis:names:tc:<wbr>SAML:2.0:status:Requester"></div><div>        <saml2p:StatusCode Value="urn:oasis:names:tc:<wbr>SAML:2.0:status:<wbr>NoAuthnContext"/></div><div>    </saml2p:StatusCode></div><div>    <saml2p:StatusMessage>An error occurred.</saml2p:<wbr>StatusMessage></div><div></saml2p:Status></div></div><div><br></div>Does someone may give a hint?<div><br></div><div><br></div><div><br></div></div>
<br>-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/<wbr>confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">users-unsubscribe@shibboleth.<wbr>net</a><br></blockquote></div><br></div>