<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<title></title>
<style type="text/css">
<!--
body{margin-left:10px;margin-right:10px;margin-top:10px;margin-bottom:10px;}
-->
</style>
</head>
<body marginleft="10" marginright="10" margintop="10" marginbottom="10">
<div align="left" style="text-align:left;"><font face="Calibri" size="+1" color="#000000" style="font-family:Calibri;font-size:14pt;color:#000000;">Thanks all.</font></div>
<div align="left" style="text-align:left;"><font face="Calibri" size="+1" color="#000000" style="font-family:Calibri;font-size:14pt;color:#000000;">The need to configure MFA so that it can require multiple authentication tokens makes perfect sense. </font></div>
<div align="left" style="text-align:left;"><font face="Calibri" size="+1" color="#000000" style="font-family:Calibri;font-size:14pt;color:#000000;">In my case it'll require both the regular password auth and auth from Duo.</font></div>
<br />
<br />
<div align="left" style="text-align:left;"><font face="Calibri" size="+1" color="#000000" style="font-family:Calibri;font-size:14pt;color:#000000;">Looking at the </font><a href="https://wiki.shibboleth.net/confluence/display/IDP30/ShibbolethSSOConfiguration" target="_blank"><font face="Calibri" size="+1" style="font-family:Calibri;font-size:14pt;">ShibbolethSSOConfig</font></a><font face="Calibri" size="+1" color="#000000" style="font-family:Calibri;font-size:14pt;color:#000000;"> and the </font><a href="https://wiki.shibboleth.net/confluence/display/IDP30/SAML2SSOConfiguration" target="_blank"><font face="Calibri" size="+1" style="font-family:Calibri;font-size:14pt;">SAML2SSOConfig</font></a><font face="Calibri" size="+1" color="#000000" style="font-family:Calibri;font-size:14pt;color:#000000;"> I see some syntax that I don't understand:</font></div>
<br />
<br />
<div align="left" style="text-align:left;"><font face="Courier New" size="+0" color="#000000" style="font-family:Courier New;font-size:10pt;color:#000000;">Examples of defaultAuthenticationMethods property</font></div>
<div align="left" style="text-align:left;"><font face="Courier New" size="+0" color="#000000" style="font-family:Courier New;font-size:10pt;color:#000000;"><!-- NOTE: these example.org constants are examples and are not suitable for real use. --></font></div>
<div align="left" style="text-align:left;"><font face="Courier New" size="+0" color="#000000" style="font-family:Courier New;font-size:10pt;color:#000000;"><bean id="MFASAML2Principal" parent="shibboleth.SAML2AuthnContextClassRef"</font></div>
<div align="left" style="text-align:left;"><font face="Courier New" size="+0" color="#000000" style="font-family:Courier New;font-size:10pt;color:#000000;"> c:_0="http://example.org/ac/classes/mfa" /></font></div>
<div align="left" style="text-align:left;"><font face="Courier New" size="+0" color="#000000" style="font-family:Courier New;font-size:10pt;color:#000000;"><bean id="MFASAML1Principal" parent="shibboleth.SAML1AuthenticationMethod"</font></div>
<div align="left" style="text-align:left;"><font face="Courier New" size="+0" color="#000000" style="font-family:Courier New;font-size:10pt;color:#000000;"> c:_0="http://example.org/ac/classes/mfa" /></font></div>
<br />
<br />
<div align="left" style="text-align:left;"><font face="Calibri" size="+1" color="#000000" style="font-family:Calibri;font-size:14pt;color:#000000;">What is up with "</font><font face="Courier New" size="+0" color="#DD0000" style="font-family:Courier New;font-size:10pt;color:#DD0000;">c:_0</font><font face="Calibri" size="+1" color="#000000" style="font-family:Calibri;font-size:14pt;color:#000000;">"? I see </font><a href="http://shibboleth.1660669.n2.nabble.com/Forcing-Duo-by-Service-Provider-td7632287.html" target="_blank"><font face="Calibri" size="+1" style="font-family:Calibri;font-size:14pt;">a thread</font></a><font face="Calibri" size="+1" color="#000000" style="font-family:Calibri;font-size:14pt;color:#000000;"> mostly between Brandon McKean and Scott from Mar 2017 where Brandon seems to use "</font><font face="Courier New" size="+0" color="#DD0000" style="font-family:Courier
New;font-size:10pt;color:#DD0000;">c:classRef</font><font face="Calibri" size="+1" color="#000000" style="font-family:Calibri;font-size:14pt;color:#000000;">" instead. That thread's especially interesting to me because he was trying to do exactly what I am.</font></div>
<br />
<div align="left" style="text-align:left;"><font face="Calibri" size="+1" color="#000000" style="font-family:Calibri;font-size:14pt;color:#000000;">Also, out of curiosity, are "</font><font face="Courier New" size="+0" color="#000000" style="font-family:Courier New;font-size:10pt;color:#000000;">MFASAML2Principal" </font><font face="Calibri" size="+1" color="#000000" style="font-family:Calibri;font-size:14pt;color:#000000;">and</font><font face="Courier New" size="+0" color="#000000" style="font-family:Courier New;font-size:10pt;color:#000000;"> "MFASAML1Principal" </font><font face="Calibri" size="+1" color="#000000" style="font-family:Calibri;font-size:14pt;color:#000000;">set in stone? Or could I use any string for this if I added it to the right config files?</font></div>
<br />
<div align="left" style="text-align:left;"><font face="Calibri" size="+1" color="#000000" style="font-family:Calibri;font-size:14pt;color:#000000;">--Clayton</font></div>
<br />
<br />
<div align="left" style="text-align:left;"><font face="Arial" size="+0" color="#000000" style="font-family:Arial;font-size:10pt;color:#000000;"><b>"Shib Users users-at-shibboleth.net |Shib|" <3unnche4it@sneakemail.com> on Friday, June 22, 2018 at 2:20 PM -0400 wrote:</b></font></div>
<div align="left" style="text-align:left;"><span style="background-color:#d0d0d0;"><font face="Times New Roman" size="+0" color="#000000" style="font-family:Times New Roman;font-size:12pt;color:#000000;">On 6/22/18, 2:13 PM, "users on behalf of Losen, Stephen C. (scl)" wrote:</font></span></div>
<br />
<div align="left" style="text-align:left;"><span style="background-color:#d0d0d0;"><font face="Times New Roman" size="+0" color="#000000" style="font-family:Times New Roman;font-size:12pt;color:#000000;">> You need to configure Multi Factor Authn (MFA). You probably want it to run Password Authn first and then run Duo. </font></span></div>
<div align="left" style="text-align:left;"><span style="background-color:#d0d0d0;"><font face="Times New Roman" size="+0" color="#000000" style="font-family:Times New Roman;font-size:12pt;color:#000000;">> And of course you must configure Duo. If the IDP is currently running Password directly, then run MFA instead.</font></span></div>
<br />
<div align="left" style="text-align:left;"><span style="background-color:#d0d0d0;"><font face="Times New Roman" size="+0" color="#000000" style="font-family:Times New Roman;font-size:12pt;color:#000000;">Relevant material being [1].</font></span></div>
<br />
<div align="left" style="text-align:left;"><span style="background-color:#d0d0d0;"><font face="Times New Roman" size="+0" color="#000000" style="font-family:Times New Roman;font-size:12pt;color:#000000;">The reason you don't see the "big picture" in the Duo topic is that Duo isn't a stand-alone solution, it's a single factor, not MFA. That tells you how to configure Duo to work but not how to combine it with other factors, and that's what most people want to do.</font></span></div>
<br />
<div align="left" style="text-align:left;"><span style="background-color:#d0d0d0;"><font face="Times New Roman" size="+0" color="#000000" style="font-family:Times New Roman;font-size:12pt;color:#000000;">The default examples for MFA that the software ships with are more than a simple use case for just running Password+Duo actually require but they're easily reducible to that. The Duo flow will automatically make use of the identity produced by the Password flow if that's the use case and there's nothing much to configure for that to work.</font></span></div>
<br />
<div align="left" style="text-align:left;"><span style="background-color:#d0d0d0;"><font face="Times New Roman" size="+0" color="#000000" style="font-family:Times New Roman;font-size:12pt;color:#000000;">-- Scott</font></span></div>
<br />
<div align="left" style="text-align:left;"><span style="background-color:#d0d0d0;"><font face="Times New Roman" size="+0" color="#000000" style="font-family:Times New Roman;font-size:12pt;color:#000000;">[1] https://wiki.shibboleth.net/confluence/display/IDP30/MultiFactorAuthnConfiguration</font></span></div>
<br />
<div align="left" style="text-align:left;"><span style="background-color:#d0d0d0;"><font face="Times New Roman" size="+0" color="#000000" style="font-family:Times New Roman;font-size:12pt;color:#000000;">-- </font></span></div>
<div align="left" style="text-align:left;"><span style="background-color:#d0d0d0;"><font face="Times New Roman" size="+0" color="#000000" style="font-family:Times New Roman;font-size:12pt;color:#000000;">For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg</font></span></div>
<br />
<br/>
</body>
</html>