<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:14.0pt;
font-family:"Calibri",sans-serif;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri",sans-serif;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoPlainText">Based on a previous email that indicated that ‘idp.authn.flows.initial’ is no longer valid, I have removed the 'idp.authn.flows.initial = Password' from idp.properties. However in testing, I now remember why I added it in the first
place. <o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">The problem I have now is that if I go to a Shibboleth protected resource that also uses DUO without first going to a Shibboleth protected resource that is not using DUO, I get an error (see errors below). I believe that this is because
I (1.) do not have a pre-existing session nor do I (2.) have a previously executed login flow. To get around this, I use the 'idp.authn.flows.initial = Password' setting.
<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Obviously if 'idp.authn.flows.initial' is no longer valid, there has to be a way to satisfy one of the pre-existing conditions for DUO. How can I force one of the above requirements to be satisfied when I go directly to a Shibboleth
and DUO protected resource that is using the DUO authn context? <o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">Here is what I use in <b>shibboleth2.xml</b> file to trigger the DUO MFA context (and I agree that the context string was not the best of choices):<o:p></o:p></p>
<p class="MsoPlainText"> <SSO entityID="https://login.emory.edu/idp/shibboleth" authnContextClassRef="https://login.emory.edu/duo"<o:p></o:p></p>
<p class="MsoPlainText"> forceAuthn="true" ><o:p></o:p></p>
<p class="MsoPlainText"> SAML2 SAML1<o:p></o:p></p>
<p class="MsoPlainText"> </SSO><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">On the IdP, in <b>general-authn.xml</b>, I have this:<o:p></o:p></p>
<p class="MsoPlainText"><bean id="authn/Duo" parent="shibboleth.AuthenticationFlow"<o:p></o:p></p>
<p class="MsoPlainText"> p:forcedAuthenticationSupported="true"<o:p></o:p></p>
<p class="MsoPlainText"> p:nonBrowserSupported="false"><o:p></o:p></p>
<p class="MsoPlainText"> <!--<o:p></o:p></p>
<p class="MsoPlainText"> The list below should be changed to reflect whatever locally- or<o:p></o:p></p>
<p class="MsoPlainText"> community-defined values are appropriate to represent MFA. It is<o:p></o:p></p>
<p class="MsoPlainText"> strongly advised that the value not be specific to Duo or any<o:p></o:p></p>
<p class="MsoPlainText"> particular technology.<o:p></o:p></p>
<p class="MsoPlainText"> --><o:p></o:p></p>
<p class="MsoPlainText"> <property name="supportedPrincipals"><o:p></o:p></p>
<p class="MsoPlainText"> <list><o:p></o:p></p>
<p class="MsoPlainText"> <bean parent="shibboleth.SAML2AuthnContextClassRef"<o:p></o:p></p>
<p class="MsoPlainText"> c:classRef="https://login.emory.edu/duo" /><o:p></o:p></p>
<p class="MsoPlainText"> <bean parent="shibboleth.SAML1AuthenticationMethod"<o:p></o:p></p>
<p class="MsoPlainText"> c:method="https://login.emory.edu/duo" /><o:p></o:p></p>
<p class="MsoPlainText"> </list><o:p></o:p></p>
<p class="MsoPlainText"> </property><o:p></o:p></p>
<p class="MsoPlainText"> </bean><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><bean id="authn/MFA" parent="shibboleth.AuthenticationFlow"<o:p></o:p></p>
<p class="MsoPlainText"> p:passiveAuthenticationSupported="true"<o:p></o:p></p>
<p class="MsoPlainText"> p:forcedAuthenticationSupported="true"><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"> <property name="supportedPrincipals"><o:p></o:p></p>
<p class="MsoPlainText"> <list><o:p></o:p></p>
<p class="MsoPlainText"> <o:p></o:p></p>
<p class="MsoPlainText"> <bean parent="shibboleth.SAML2AuthnContextClassRef"<o:p></o:p></p>
<p class="MsoPlainText"> c:classRef="https://login.emory.edu/duo" /><o:p></o:p></p>
<p class="MsoPlainText"> <bean parent="shibboleth.SAML1AuthenticationMethod"<o:p></o:p></p>
<p class="MsoPlainText"> c:method="https://login.emory.edu/duo" /><o:p></o:p></p>
<p class="MsoPlainText"> <o:p></o:p></p>
<p class="MsoPlainText"> <bean parent="shibboleth.SAML2AuthnContextClassRef"<o:p></o:p></p>
<p class="MsoPlainText"> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" /><o:p></o:p></p>
<p class="MsoPlainText"> <bean parent="shibboleth.SAML2AuthnContextClassRef"<o:p></o:p></p>
<p class="MsoPlainText"> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:Password" /><o:p></o:p></p>
<p class="MsoPlainText"> <bean parent="shibboleth.SAML1AuthenticationMethod"<o:p></o:p></p>
<p class="MsoPlainText"> c:method="urn:oasis:names:tc:SAML:1.0:am:password" /><o:p></o:p></p>
<p class="MsoPlainText"> </list><o:p></o:p></p>
<p class="MsoPlainText"> </property><o:p></o:p></p>
<p class="MsoPlainText"> </bean><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><b>(error from IdP logs)<o:p></o:p></b></p>
<p class="MsoPlainText">2019-05-31 07:48:25,000 - 127.0.0.1 - ERROR [net.shibboleth.idp.authn.duo:-2] - DuoWebException<o:p></o:p></p>
<p class="MsoPlainText">org.springframework.expression.ExpressionInvocationTargetException: A problem occurred when trying to execute method 'generateSignedRequestToken' on object of type [java.lang.Class]<o:p></o:p></p>
<p class="MsoPlainText"> at org.springframework.expression.spel.ast.MethodReference.throwSimpleExceptionIfPossible(MethodReference.java:237)<o:p></o:p></p>
<p class="MsoPlainText">Caused by: com.duosecurity.duoweb.DuoWebException: ERR|The username passed to sign_request() is invalid.<o:p></o:p></p>
<p class="MsoPlainText"> at net.shibboleth.idp.authn.duo.impl.DuoSupport.generateSignedRequestToken(DuoSupport.java:84)<o:p></o:p></p>
<p class="MsoPlainText">2019-05-31 07:48:25,008 - 127.0.0.1 - WARN [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event occurred while processing the request: AuthenticationException<o:p></o:p></p>
<p class="MsoPlainText">2019-05-31 07:48:25,104<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><b>(browser error message)<o:p></o:p></b></p>
<p class="MsoPlainText">opensaml::FatalProfileException<o:p></o:p></p>
<p class="MsoPlainText">The system encountered an error at Fri May 31 08:01:08 2019<o:p></o:p></p>
<p class="MsoPlainText">To report this problem, please contact the site administrator at root@localhost.<o:p></o:p></p>
<p class="MsoPlainText">Please include the following message in any email:<o:p></o:p></p>
<p class="MsoPlainText">opensaml::FatalProfileException at (https://gerry.emory.edu/Shibboleth.sso/SAML2/POST)<o:p></o:p></p>
<p class="MsoPlainText">SAML response reported an IdP error.<o:p></o:p></p>
<p class="MsoPlainText">Error from identity provider:<o:p></o:p></p>
<p class="MsoPlainText"> Status: urn:oasis:names:tc:SAML:2.0:status:Requester<o:p></o:p></p>
<p class="MsoPlainText"> Sub-Status: urn:oasis:names:tc:SAML:2.0:status:AuthnFailed<o:p></o:p></p>
<p class="MsoPlainText"> Message: An error occurred.<o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText"> <o:p></o:p></p>
</div>
<br>
<hr>
<font face="Arial" color="Gray" size="1"><br>
This e-mail message (including any attachments) is for the sole use of<br>
the intended recipient(s) and may contain confidential and privileged<br>
information. If the reader of this message is not the intended<br>
recipient, you are hereby notified that any dissemination, distribution<br>
or copying of this message (including any attachments) is strictly<br>
prohibited.<br>
<br>
If you have received this message in error, please contact<br>
the sender by reply e-mail message and destroy all copies of the<br>
original message (including attachments).<br>
</font>
</body>
</html>