<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<title></title>
<style type="text/css">
<!--
body{margin-left:10px;margin-right:10px;margin-top:10px;margin-bottom:10px;}
-->
</style>
</head>
<body marginleft="10" marginright="10" margintop="10" marginbottom="10">
<div align="left" style="text-align:left;"><font face="Calibri" size="+1" color="#000000" style="font-family:Calibri;font-size:14pt;color:#000000;">I never got to the point of triggering Duo for every SP - I found the setting that let's us enable it per-SP which is where I was trying to go in the first place.</font></div>
<br />
<div align="left" style="text-align:left;"><font face="Calibri" size="+1" color="#000000" style="font-family:Calibri;font-size:14pt;color:#000000;">In relying-party.xml there's this section:</font></div>
<div align="left" style="text-align:left;"><font face="Calibri" size="+1" color="#000000" style="font-family:Calibri;font-size:14pt;color:#000000;"> <util:list id="shibboleth.RelyingPartyOverrides"></font></div>
<br />
<div align="left" style="text-align:left;"><font face="Calibri" size="+1" color="#000000" style="font-family:Calibri;font-size:14pt;color:#000000;">Within it there's a bean for each SP for which you want to override defaults.</font></div>
<div align="left" style="text-align:left;"><font face="Calibri" size="+1" color="#000000" style="font-family:Calibri;font-size:14pt;color:#000000;">The part in red is what made-it-go for me</font></div>
<br />
<div align="left" style="text-align:left;"><font face="Courier New" size="+0" color="#000000" style="font-family:Courier New;font-size:10pt;color:#000000;"><bean parent="RelyingPartyByName" c:relyingPartyIds="#{{'http://the.sp.com/theirSPEntityID'}}"></font></div>
<div align="left" style="text-align:left;"><font face="Courier New" size="+0" color="#000000" style="font-family:Courier New;font-size:10pt;color:#000000;"> <property name="profileConfigurations"></font></div>
<div align="left" style="text-align:left;"><font face="Courier New" size="+0" color="#000000" style="font-family:Courier New;font-size:10pt;color:#000000;"> <list></font></div>
<div align="left" style="text-align:left;"><font face="Courier New" size="+0" color="#000000" style="font-family:Courier New;font-size:10pt;color:#000000;"> <bean parent="SAML2.SSO" p:encryptAssertions="true" p:encryptNameIDs="true" p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:2.0:nameid-format:OurCustomFormat1" </font><font face="Courier New" size="+0" color="#DD0000" style="font-family:Courier New;font-size:10pt;color:#DD0000;">p:authenticationFlows="#{{'MFA'}}"</font><font face="Courier New" size="+0" color="#000000" style="font-family:Courier New;font-size:10pt;color:#000000;">></font></div>
<div align="left" style="text-align:left;"><font face="Courier New" size="+0" color="#000000" style="font-family:Courier New;font-size:10pt;color:#000000;"> </bean></font></div>
<div align="left" style="text-align:left;"><font face="Courier New" size="+0" color="#000000" style="font-family:Courier New;font-size:10pt;color:#000000;"> </list></font></div>
<div align="left" style="text-align:left;"><font face="Courier New" size="+0" color="#000000" style="font-family:Courier New;font-size:10pt;color:#000000;"> </property></font></div>
<div align="left" style="text-align:left;"><font face="Courier New" size="+0" color="#000000" style="font-family:Courier New;font-size:10pt;color:#000000;"></bean></font></div>
<br />
<div align="left" style="text-align:left;"><font face="Calibri" size="+1" color="#000000" style="font-family:Calibri;font-size:14pt;color:#000000;">It's all there in Shib3's Relying Party documentation.</font></div>
<br />
<div align="left" style="text-align:left;"><font face="Calibri" size="+1" color="#000000" style="font-family:Calibri;font-size:14pt;color:#000000;">I think </font><a href="https://wiki.shibboleth.net/confluence/display/IDP30/ShibbolethSSOConfiguration" target="_blank"><font face="Calibri" size="+1" style="font-family:Calibri;font-size:14pt;">the examples I was looking at</font></a><font face="Calibri" size="+1" color="#000000" style="font-family:Calibri;font-size:14pt;color:#000000;"> achieved this a different way. They were defining "</font><font face="Courier" size="+0" color="#000000" style="font-family:Courier;font-size:12pt;color:#000000;">MFASAML2Principal</font><font face="Calibri" size="+1" color="#000000" style="font-family:Calibri;font-size:14pt;color:#000000;">" beans and then referencing them in different places. I don't understand the advantage of going that route. More re-usable objects I guess? Maybe useful if you're also expecting some
SP's to request MFA occaisonally?</font></div>
<br />
<div align="left" style="text-align:left;"><font face="Calibri" size="+1" color="#000000" style="font-family:Calibri;font-size:14pt;color:#000000;">--Clayton</font></div>
<br />
<br />
<br />
<div align="left" style="text-align:left;"><font face="Arial" size="+0" color="#000000" style="font-family:Arial;font-size:10pt;color:#000000;"><b>Clayton Burton on Friday, June 22, 2018 at 3:48 PM -0400 wrote:</b></font></div>
<div align="left" style="text-align:left;"><span style="background-color:#d0d0d0;"><font face="Calibri" size="+1" color="#000000" style="font-family:Calibri;font-size:14pt;color:#000000;">Thanks all.</font></span></div>
<div align="left" style="text-align:left;"><span style="background-color:#d0d0d0;"><font face="Calibri" size="+1" color="#000000" style="font-family:Calibri;font-size:14pt;color:#000000;">The need to configure MFA so that it can require multiple authentication tokens makes perfect sense. </font></span></div>
<div align="left" style="text-align:left;"><span style="background-color:#d0d0d0;"><font face="Calibri" size="+1" color="#000000" style="font-family:Calibri;font-size:14pt;color:#000000;">In my case it'll require both the regular password auth and auth from Duo.</font></span></div>
<br />
<br />
<div align="left" style="text-align:left;"><span style="background-color:#d0d0d0;"><font face="Calibri" size="+1" color="#000000" style="font-family:Calibri;font-size:14pt;color:#000000;">Looking at the </font></span><a href="https://wiki.shibboleth.net/confluence/display/IDP30/ShibbolethSSOConfiguration" target="_blank"><span style="background-color:#d0d0d0;"><font face="Calibri" size="+1" style="font-family:Calibri;font-size:14pt;">ShibbolethSSOConfig</font></span></a><span style="background-color:#d0d0d0;"><font face="Calibri" size="+1" color="#000000" style="font-family:Calibri;font-size:14pt;color:#000000;"> and the </font></span><a href="https://wiki.shibboleth.net/confluence/display/IDP30/SAML2SSOConfiguration" target="_blank"><span style="background-color:#d0d0d0;"><font face="Calibri" size="+1" style="font-family:Calibri;font-size:14pt;">SAML2SSOConfig</font></span></a><span style="background-color:#d0d0d0;"><font face="Calibri" size="+1" color="#000000"
style="font-family:Calibri;font-size:14pt;color:#000000;"> I see some syntax that I don't understand:</font></span></div>
<br />
<br />
<div align="left" style="text-align:left;"><span style="background-color:#d0d0d0;"><font face="Courier New" size="+0" color="#000000" style="font-family:Courier New;font-size:10pt;color:#000000;">Examples of defaultAuthenticationMethods property</font></span></div>
<div align="left" style="text-align:left;"><span style="background-color:#d0d0d0;"><font face="Courier New" size="+0" color="#000000" style="font-family:Courier New;font-size:10pt;color:#000000;"><!-- NOTE: these example.org constants are examples and are not suitable for real use. --></font></span></div>
<div align="left" style="text-align:left;"><span style="background-color:#d0d0d0;"><font face="Courier New" size="+0" color="#000000" style="font-family:Courier New;font-size:10pt;color:#000000;"><bean id="MFASAML2Principal" parent="shibboleth.SAML2AuthnContextClassRef"</font></span></div>
<div align="left" style="text-align:left;"><span style="background-color:#d0d0d0;"><font face="Courier New" size="+0" color="#000000" style="font-family:Courier New;font-size:10pt;color:#000000;"> c:_0="http://example.org/ac/classes/mfa" /></font></span></div>
<div align="left" style="text-align:left;"><span style="background-color:#d0d0d0;"><font face="Courier New" size="+0" color="#000000" style="font-family:Courier New;font-size:10pt;color:#000000;"><bean id="MFASAML1Principal" parent="shibboleth.SAML1AuthenticationMethod"</font></span></div>
<div align="left" style="text-align:left;"><span style="background-color:#d0d0d0;"><font face="Courier New" size="+0" color="#000000" style="font-family:Courier New;font-size:10pt;color:#000000;"> c:_0="http://example.org/ac/classes/mfa" /></font></span></div>
<br />
<br />
<div align="left" style="text-align:left;"><span style="background-color:#d0d0d0;"><font face="Calibri" size="+1" color="#000000" style="font-family:Calibri;font-size:14pt;color:#000000;">What is up with "</font></span><span style="background-color:#d0d0d0;"><font face="Courier New" size="+0" color="#DD0000" style="font-family:Courier New;font-size:10pt;color:#DD0000;">c:_0</font></span><span style="background-color:#d0d0d0;"><font face="Calibri" size="+1" color="#000000" style="font-family:Calibri;font-size:14pt;color:#000000;">"? I see </font></span><a href="http://shibboleth.1660669.n2.nabble.com/Forcing-Duo-by-Service-Provider-td7632287.html" target="_blank"><span style="background-color:#d0d0d0;"><font face="Calibri" size="+1" style="font-family:Calibri;font-size:14pt;">a thread</font></span></a><span style="background-color:#d0d0d0;"><font face="Calibri" size="+1" color="#000000" style="font-family:Calibri;font-size:14pt;color:#000000;"> mostly between Brandon
McKean and Scott from Mar 2017 where Brandon seems to use "</font></span><span style="background-color:#d0d0d0;"><font face="Courier New" size="+0" color="#DD0000" style="font-family:Courier New;font-size:10pt;color:#DD0000;">c:classRef</font></span><span style="background-color:#d0d0d0;"><font face="Calibri" size="+1" color="#000000" style="font-family:Calibri;font-size:14pt;color:#000000;">" instead. That thread's especially interesting to me because he was trying to do exactly what I am.</font></span></div>
<br />
<div align="left" style="text-align:left;"><span style="background-color:#d0d0d0;"><font face="Calibri" size="+1" color="#000000" style="font-family:Calibri;font-size:14pt;color:#000000;">Also, out of curiosity, are "</font></span><span style="background-color:#d0d0d0;"><font face="Courier New" size="+0" color="#000000" style="font-family:Courier New;font-size:10pt;color:#000000;">MFASAML2Principal" </font></span><span style="background-color:#d0d0d0;"><font face="Calibri" size="+1" color="#000000" style="font-family:Calibri;font-size:14pt;color:#000000;">and</font></span><span style="background-color:#d0d0d0;"><font face="Courier New" size="+0" color="#000000" style="font-family:Courier New;font-size:10pt;color:#000000;"> "MFASAML1Principal" </font></span><span style="background-color:#d0d0d0;"><font face="Calibri" size="+1" color="#000000" style="font-family:Calibri;font-size:14pt;color:#000000;">set in stone? Or could I use any string for this if I added it
to the right config files?</font></span></div>
<br />
<div align="left" style="text-align:left;"><span style="background-color:#d0d0d0;"><font face="Calibri" size="+1" color="#000000" style="font-family:Calibri;font-size:14pt;color:#000000;">--Clayton</font></span></div>
<br />
<br />
<div align="left" style="text-align:left;"><span style="background-color:#d0d0d0;"><font face="Arial" size="+0" color="#000000" style="font-family:Arial;font-size:10pt;color:#000000;"><b>"Shib Users users-at-shibboleth.net |Shib|" <3unnche4it@sneakemail.com> on Friday, June 22, 2018 at 2:20 PM -0400 wrote:</b></font></span></div>
<div align="left" style="text-align:left;"><span style="background-color:#d0d0d0;"><font face="Times New Roman" size="+0" color="#000000" style="font-family:Times New Roman;font-size:12pt;color:#000000;">On 6/22/18, 2:13 PM, "users on behalf of Losen, Stephen C. (scl)" wrote:</font></span></div>
<br />
<div align="left" style="text-align:left;"><span style="background-color:#d0d0d0;"><font face="Times New Roman" size="+0" color="#000000" style="font-family:Times New Roman;font-size:12pt;color:#000000;">> You need to configure Multi Factor Authn (MFA). You probably want it to run Password Authn first and then run Duo. </font></span></div>
<div align="left" style="text-align:left;"><span style="background-color:#d0d0d0;"><font face="Times New Roman" size="+0" color="#000000" style="font-family:Times New Roman;font-size:12pt;color:#000000;">> And of course you must configure Duo. If the IDP is currently running Password directly, then run MFA instead.</font></span></div>
<br />
<div align="left" style="text-align:left;"><span style="background-color:#d0d0d0;"><font face="Times New Roman" size="+0" color="#000000" style="font-family:Times New Roman;font-size:12pt;color:#000000;">Relevant material being [1].</font></span></div>
<br />
<div align="left" style="text-align:left;"><span style="background-color:#d0d0d0;"><font face="Times New Roman" size="+0" color="#000000" style="font-family:Times New Roman;font-size:12pt;color:#000000;">The reason you don't see the "big picture" in the Duo topic is that Duo isn't a stand-alone solution, it's a single factor, not MFA. That tells you how to configure Duo to work but not how to combine it with other factors, and that's what most people want to do.</font></span></div>
<br />
<div align="left" style="text-align:left;"><span style="background-color:#d0d0d0;"><font face="Times New Roman" size="+0" color="#000000" style="font-family:Times New Roman;font-size:12pt;color:#000000;">The default examples for MFA that the software ships with are more than a simple use case for just running Password+Duo actually require but they're easily reducible to that. The Duo flow will automatically make use of the identity produced by the Password flow if that's the use case and there's nothing much to configure for that to work.</font></span></div>
<br />
<div align="left" style="text-align:left;"><span style="background-color:#d0d0d0;"><font face="Times New Roman" size="+0" color="#000000" style="font-family:Times New Roman;font-size:12pt;color:#000000;">-- Scott</font></span></div>
<br />
<div align="left" style="text-align:left;"><span style="background-color:#d0d0d0;"><font face="Times New Roman" size="+0" color="#000000" style="font-family:Times New Roman;font-size:12pt;color:#000000;">[1] https://wiki.shibboleth.net/confluence/display/IDP30/MultiFactorAuthnConfiguration</font></span></div>
<br />
<div align="left" style="text-align:left;"><span style="background-color:#d0d0d0;"><font face="Times New Roman" size="+0" color="#000000" style="font-family:Times New Roman;font-size:12pt;color:#000000;">-- </font></span></div>
<div align="left" style="text-align:left;"><span style="background-color:#d0d0d0;"><font face="Times New Roman" size="+0" color="#000000" style="font-family:Times New Roman;font-size:12pt;color:#000000;">For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg</font></span></div>
<br />
<br />
<br/>
</body>
</html>