<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>Hi list,</p>
<p>this is somewhat complicated. IdP v3.4.3. I want Password, or
SPNEGO, as a first factor, and a second factor if the user has
registered a TOTP token in our privacyIDEA server.</p>
<p>Without SPNEGO, this worked as intended. Now I followed the
SPNEGOAuthnConfiguration topic as we usually do. If the user has
no 2FA Token, this works as well. However we do not seem to get
both working - we are hitting an error and the MFA logic seems
weird. For once, it looks as if c14n is being applied twice,
erroneously. On the other hand, logs first say MFA is complete,
and then it's incomplete. Do you have some idea what is wrong?</p>
<p>Regards</p>
<p>Martin<br>
</p>
<p>Here are some config snippets:<br>
</p>
<p>idp.authn.flows=SPNEGO|MFA<br>
</p>
<p><util:map id="shibboleth.authn.MFA.TransitionMap"><br>
<entry key=""><br>
<bean parent="shibboleth.authn.MFA.Transition"
p:nextFlow="authn/Password" /><br>
</entry><br>
</p>
<p> <entry key="authn/Password"><br>
<bean parent="shibboleth.authn.MFA.Transition"
p:nextFlowStrategy-ref="checkFor2FAToken" /> <!-- returns
authn/privacyidea or null --><br>
</entry><br>
<br>
<entry key="authn/SPNEGO"><br>
<bean parent="shibboleth.authn.MFA.Transition"
p:nextFlowStrategy-ref="checkFor2FAToken" /> <!-- returns
authn/privacyidea or null --><br>
</entry><br>
</util:map><br>
</p>
<p><util:list id="shibboleth.c14n.simple.Transforms"><br>
<bean parent="shibboleth.Pair"
p:first=<a class="moz-txt-link-rfc2396E" href="mailto:^(.+)@DOMAIN\.ORG$">"^(.+)@DOMAIN\.ORG$"</a> p:second="$1" /><br>
</util:list><br>
</p>
<p>And here some log extracts:</p>
<p>2019-09-25 10:42:08,409 - 10.51.0.44 - DEBUG
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:264] -
Profile Action SelectAuthenticationFlow: No specific Principals
requested<br>
2019-09-25 10:42:08,409 - 10.51.0.44 - DEBUG
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:309] -
Profile Action SelectAuthenticationFlow: No usable active results
available, selecting an inactive flow<br>
2019-09-25 10:42:08,409 - 10.51.0.44 - DEBUG
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:363] -
Profile Action SelectAuthenticationFlow: Selecting inactive
authentication flow authn/MFA</p>
<p>2019-09-25 10:42:08,567 - 10.51.0.44 - DEBUG
[net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:221]
- Profile Action TransitionMultiFactorAuthentication: MFA flow
transition after 'proceed' event to 'authn/Password' flow</p>
<p>(user pushes SPNEGO Button)<br>
</p>
<p>2019-09-25 10:42:16,943 - 10.51.0.44 - TRACE
[net.shibboleth.idp.authn.spnego.impl.SPNEGOAuthnController:100] -
SPNEGO negotiation started, answering request with 401
(WWW-Authenticate: Negotiate)<br>
</p>
<p>2019-09-25 10:42:17,067 - 10.51.0.44 - INFO
[net.shibboleth.idp.authn.impl.ValidateExternalAuthentication:139]
- Profile Action ValidateExternalAuthentication: External
authentication succeeded for Subject: [UsernamePrincipal{username=<b><a class="moz-txt-link-abbreviated" href="mailto:userabc@DOMAIN.ORG">userabc@DOMAIN.ORG</a></b>},
<a class="moz-txt-link-abbreviated" href="mailto:userabc@DOMAIN.ORG">userabc@DOMAIN.ORG</a>]</p>
<p>2019-09-25 10:42:17,332 - 10.51.0.44 - DEBUG
[net.shibboleth.idp.authn.AbstractSubjectCanonicalizationAction:247]
- Profile Action <b>SimpleSubjectCanonicalization: result of
replacement is 'userabc'</b><br>
2019-09-25 10:42:17,340 - 10.51.0.44 - DEBUG
[net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:192]
- Profile Action TransitionMultiFactorAuthentication: Preserving
authentication result from 'authn/SPNEGO' flow<br>
2019-09-25 10:42:17,341 - 10.51.0.44 - DEBUG
[net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:209]
- Profile Action TransitionMultiFactorAuthentication: Applying MFA
transition rule to exit state 'authn/Password'<br>
2019-09-25 10:42:17,359 - 10.51.0.44 - DEBUG [checkFor2FAToken:3]
- Checking if user is enabled for 2FA<br>
2019-09-25 10:42:17,424 - 10.51.0.44 - DEBUG [checkFor2FAToken:11]
- Looking up user: userabc<br>
2019-09-25 10:42:17,431 - 10.51.0.44 - DEBUG
[ca.ab.concordia.privacyIDEAtfa.TokenGenerator:124] - Checking if
user has one or more tokens</p>
<p>2019-09-25 10:42:18,269 - 10.51.0.44 - DEBUG
[checkFor2FAToken:19] - Token(s) found for userabc. Proceeding to
authentication.<br>
2019-09-25 10:42:18,270 - 10.51.0.44 - DEBUG
[net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:221]
- Profile Action TransitionMultiFactorAuthentication: MFA flow
transition after 'proceed' event to 'authn/privacyidea' flow<br>
</p>
<p>(user inputs TOTP token)<br>
</p>
<p>2019-09-25 10:42:21,621 - 10.51.0.44 - DEBUG
[net.shibboleth.idp.authn.AbstractValidationAction:354] - Profile
Action TokenValidator: Adding custom Principal(s) defined on
underlying flow descriptor<br>
2019-09-25 10:42:21,621 - 10.51.0.44 - DEBUG
[ca.ab.concordia.privacyIDEAtfa.TokenValidator:77] - Profile
Action TokenValidator: TokenValidator populateSubject is called<br>
2019-09-25 10:42:21,622 - 10.51.0.44 - DEBUG
[ca.ab.concordia.privacyIDEAtfa.TokenValidator:79] - Profile
Action TokenValidator: Populate subject <b>userabc</b><br>
2019-09-25 10:42:21,628 - 10.51.0.44 - DEBUG
[net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:192]
- Profile Action TransitionMultiFactorAuthentication: Preserving
authentication result from 'authn/privacyidea' flow<br>
019-09-25 10:42:21,629 - 10.51.0.44 - DEBUG
[net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:209]
- Profile Action TransitionMultiFactorAuthentication: Applying MFA
transition rule to exit state 'authn/privacyidea'<br>
2019-09-25 10:42:21,629 - 10.51.0.44 - DEBUG
[net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:226]
- Profile Action TransitionMultiFactorAuthentication: MFA flow
completing with event 'proceed'<br>
2019-09-25 10:42:21,640 - 10.51.0.44 - DEBUG
[net.shibboleth.idp.authn.impl.FinalizeMultiFactorAuthentication:193]
- Profile Action FinalizeMultiFactorAuthentication: <b>MFA
complete</b>, producing merged result<br>
</p>
<p>2019-09-25 10:42:21,648 - 10.51.0.44 - DEBUG
[net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext:79]
- Profile Action PopulateSubjectCanonicalizationContext:
Installing 2 canonicalization flows into SubjectCanonicalization</p>
<p>2019-09-25 10:42:21,650 - 10.51.0.44 - DEBUG
[net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100]
- Profile Action SelectSubjectCanonicalizationFlow: Checking
canonicalization flow c14n/x500 for applicability...<br>
2019-09-25 10:42:21,650 - 10.51.0.44 - DEBUG
[net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:106]
- Profile Action SelectSubjectCanonicalizationFlow:
Canonicalization flow c14n/x500 was not applicable to this request<br>
2019-09-25 10:42:21,651 - 10.51.0.44 - DEBUG
[net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100]
- Profile Action SelectSubjectCanonicalizationFlow: Checking
canonicalization flow c14n/simple for applicability...<br>
2019-09-25 10:42:21,651 - 10.51.0.44 - DEBUG
[net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:106]
- Profile Action SelectSubjectCanonicalizationFlow:
Canonicalization flow c14n/simple was not applicable to this
request<br>
2019-09-25 10:42:21,651 - 10.51.0.44 - <b>ERROR</b>
[net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:78]
- Profile Action SelectSubjectCanonicalizationFlow: No potential
flows left to choose from, canonicalization will fail<br>
</p>
<p>2019-09-25 10:42:21,679 - 10.51.0.44 - INFO
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:138] -
Profile Action SelectAuthenticationFlow: Moving <b>incomplete
flow authn/MFA</b> to intermediate set<br>
2019-09-25 10:42:21,680 - 10.51.0.44 - DEBUG
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:264] -
Profile Action SelectAuthenticationFlow: No specific Principals
requested<br>
2019-09-25 10:42:21,680 - 10.51.0.44 - DEBUG
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:309] -
Profile Action SelectAuthenticationFlow: No usable active results
available, selecting an inactive flow<br>
2019-09-25 10:42:21,702 - 10.51.0.44 - DEBUG
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:363] -
Profile Action SelectAuthenticationFlow: Selecting inactive
authentication flow authn/SPNEGO<br>
2019-09-25 10:42:21,704 - 10.51.0.44 - INFO
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:138] -
Profile Action SelectAuthenticationFlow: Moving incomplete flow
authn/SPNEGO to intermediate set<br>
2019-09-25 10:42:21,704 - 10.51.0.44 - DEBUG
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:264] -
Profile Action SelectAuthenticationFlow: No specific Principals
requested<br>
2019-09-25 10:42:21,705 - 10.51.0.44 - DEBUG
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:309] -
Profile Action SelectAuthenticationFlow: No usable active results
available, selecting an inactive flow<br>
2019-09-25 10:42:21,705 - 10.51.0.44 - INFO
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:313] -
Profile Action SelectAuthenticationFlow: No potential flows left
to choose from, authentication failed<br>
2019-09-25 10:42:21,724 - 10.51.0.44 - DEBUG
[org.opensaml.saml.common.profile.logic.DefaultLocalErrorPredicate:173]
- Error event NoPotentialFlow will be handled with response<br>
<br>
</p>
<p><br>
</p>
<p><br>
</p>
<p><br>
</p>
<p><br>
</p>
<p><br>
</p>
<pre class="moz-signature" cols="72">--
Dr. Martin Haase, Solutions Engineer
DAASI International GmbH
Europaplatz 3
D-72072 Tübingen
Germany
phone: +49 7071 407109-0
fax: +49 7071 407109-9
email: <a class="moz-txt-link-abbreviated" href="mailto:martin.haase@daasi.de">martin.haase@daasi.de</a>
web: <a class="moz-txt-link-abbreviated" href="http://www.daasi.de">www.daasi.de</a>
Sitz der Gesellschaft: Tübingen
Registergericht: Amtsgericht Stuttgart, HRB 382175
Geschäftsleitung: Peter Gietz
</pre>
</body>
</html>