<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
.MsoChpDefault
{mso-style-type:export-only;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style>
</head>
<body lang="EN-US" link="blue" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Julian,</p>
<p class="MsoNormal">I believe the timeout settings in the beans in general-authn are applied to the particular flow that was called. I *<b>believe</b>* they become irrelevant if the flows are called via another flow (in this case, password is called via the
mfa flow, so the only timeout setting that would be evaluated is the one for the mfa flow itself).</p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">There’s probably some logic that you could put in a custom script in the mfa flow that could check the status of the password timeout, but I wouldn’t know off hand where to do that. Rather than call authn/Password directly, you would have
a custom script that checks the password timeout, and only calls authn/Password if it’s already timed out. Otherwise, call authn/Totp. It should be straightforward enough to see if it’s possible.</p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">What plugin are you using for the totp authn? I developed a totp plugin based on some work by another community member which leverages the attribute resolver to pull the encrypted seeds from an attribute store. I posted It here on the
mailing list a while back.</p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Sent from <a href="https://go.microsoft.com/fwlink/?LinkId=550986">
Mail</a> for Windows 10</p>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Julian Williams <julian.williams@it.ox.ac.uk><br>
<b>Sent:</b> Monday, February 10, 2020 9:53:56 AM<br>
<b>To:</b> users@shibboleth.net <users@shibboleth.net><br>
<b>Subject:</b> Forcing the timeout of 2nd factor in a MFA login</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">[EXTERNAL EMAIL]<br>
<br>
Dear Shibboleth users,<br>
<br>
We are testing a new MFA flow with IdP 3.4 which uses the standard<br>
Password flow as the first factor and an custom flow that checks an OTP<br>
as the second factor. This is used by only one application here and that<br>
uses a Shibboleth Service Provider which we have control over. The MFA<br>
flow is chosen when the SP requests a authnContextClassRef of<br>
"urn:oasis:names:tc:SAML:2.0:ac:classes:TimeSyncToken".<br>
<br>
Is there any way of reducing the session lifetime of the second factor<br>
to 15min whilst keeping the default/Password lifetime to 10hours?<br>
Ideally what we'd like is for the application to request a new<br>
authentication after 15min of inactivity and we want users to just be<br>
prompted for the 2nd factor and not their password again.<br>
<br>
I've experimented with changing various things but at the moment I can<br>
either trigger the whole MFA flow to rerun, including asking for the<br>
password, or not at all.<br>
<br>
These are the pertinent config setting I think...<br>
<br>
#### conf/idp.properties ####<br>
<br>
idp.session.timeout = PT10H<br>
idp.authn.flows= MFA<br>
idp.authn.defaultLifetime = PT10H<br>
idp.authn.defaultTimeout = PT10H<br>
<br>
<br>
<br>
#### conf/authn/general-authn.xml ####<br>
...<br>
<bean id="authn/MFA" parent="shibboleth.AuthenticationFlow"<br>
p:passiveAuthenticationSupported="true"<br>
p:forcedAuthenticationSupported="true"<br>
p:lifetime="PT15M"><br>
...<br>
<bean id="authn/Password" parent="shibboleth.AuthenticationFlow"<br>
p:passiveAuthenticationSupported="true"<br>
p:forcedAuthenticationSupported="true" /><br>
...<br>
<bean id="authn/AVWebFlow" parent="shibboleth.AuthenticationFlow"<br>
p:nonBrowserSupported="false"<br>
p:forcedAuthenticationSupported="true"<br>
p:lifetime="PT15M"><br>
...<br>
<br>
<br>
#### conf/authn/mfa-authn-config.xml ####<br>
<br>
<util:map id="shibboleth.authn.MFA.TransitionMap"><br>
<!-- First rule runs the Password login flow. --><br>
<entry key=""><br>
<bean parent="shibboleth.authn.MFA.Transition"<br>
p:nextFlow="authn/Password" /><br>
</entry><br>
<br>
<entry key="authn/Password"><br>
<bean parent="shibboleth.authn.MFA.Transition"<br>
p:nextFlowStrategy-ref="checkSecondFactor" /><br>
</entry><br>
<br>
<!-- An implicit final rule will return whatever the final flow<br>
returns. --><br>
</util:map><br>
<br>
<!-- Example script to see if second factor is required. --><br>
<bean id="checkSecondFactor"<br>
parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript"<br>
p:customObject-ref="shibboleth.AttributeResolverService"><br>
<constructor-arg><br>
<value><br>
<![CDATA[<br>
nextFlow = "authn/AVWebFlow";<br>
<br>
authCtx =<br>
input.getSubcontext("net.shibboleth.idp.authn.context.AuthenticationContext");<br>
mfaCtx =<br>
authCtx.getSubcontext("net.shibboleth.idp.authn.context.MultiFactorAuthenticationContext");<br>
if (mfaCtx.isAcceptable()) {<br>
nextFlow = null;<br>
}<br>
<br>
nextFlow; // pass control to second factor or end<br>
with the first<br>
]]><br>
</value><br>
</constructor-arg><br>
</bean><br>
<br>
<br>
If I just set the p:lifetime="PT15M" on the bean for the 2nd factor flow<br>
(authn/AVWebFlow) the IdP appears to ignore it and carrying on issuing<br>
assertions after the 15min has elapsed. If I also set this lifetime on<br>
the MFA bean (authn/MFA) then the lifetime is honored but then I get<br>
prompts for both factors which isn't what I'd like.<br>
<br>
I've also tried using a maxTimeSinceAuthn setting on the SP but all that<br>
does is make the SP throw an error and doesn't force a re-authentication<br>
which is what we were hoping for.<br>
<br>
We could also set forceAuthn="true" on the SP side but I'm assuming that<br>
that will trigger the complete MFA flow to run i.e. both factors.<br>
<br>
Any advice much appreciated.<br>
<br>
Cheers,<br>
<br>
Julian<br>
--<br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font></div>
</body>
</html>