<div dir="ltr"><div>Thank you. Appreciate the guidance.<br></div><div><br></div><div>I reverted 'general-authn.xml' back to the original file from a '3.4.6' download (full file below) -- still not getting '<a href="http://shibboleth.ent/ns/profiles/saml2/sso/ecp" target="_blank">http://shibboleth.ent/ns/profiles/saml2/sso/ecp</a>' for ECP in the logging output for 'checkSecondFactor' in 'mfa-authn-config.xml'.</div><div><br></div><div>Should "p:nonBrowserSupported="false"" -- be changed to "true" (I've previously tried either -- but I may have messed up elsewhere). I have set up duo.properties for the default 'idp.duo.nonbrowser.*' keys.</div><div><br></div><div>All hunky-dory with '<a href="http://shibboleth.net/ns/profiles/saml2/sso/browser" target="_blank">http://shibboleth.net/ns/profiles/saml2/sso/browser</a>'. <br></div><div><br></div><div><?xml version="1.0" encoding="UTF-8"?><br><beans xmlns="<a href="http://www.springframework.org/schema/beans">http://www.springframework.org/schema/beans</a>"<br> xmlns:context="<a href="http://www.springframework.org/schema/context">http://www.springframework.org/schema/context</a>"<br> xmlns:util="<a href="http://www.springframework.org/schema/util">http://www.springframework.org/schema/util</a>"<br> xmlns:p="<a href="http://www.springframework.org/schema/p">http://www.springframework.org/schema/p</a>"<br> xmlns:c="<a href="http://www.springframework.org/schema/c">http://www.springframework.org/schema/c</a>"<br> xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance">http://www.w3.org/2001/XMLSchema-instance</a>"<br> xsi:schemaLocation="<a href="http://www.springframework.org/schema/beans">http://www.springframework.org/schema/beans</a> <a href="http://www.springframework.org/schema/beans/spring-beans.xsd">http://www.springframework.org/schema/beans/spring-beans.xsd</a><br> <a href="http://www.springframework.org/schema/context">http://www.springframework.org/schema/context</a> <a href="http://www.springframework.org/schema/context/spring-context.xsd">http://www.springframework.org/schema/context/spring-context.xsd</a><br> <a href="http://www.springframework.org/schema/util">http://www.springframework.org/schema/util</a> <a href="http://www.springframework.org/schema/util/spring-util.xsd">http://www.springframework.org/schema/util/spring-util.xsd</a>"<br> <br> default-init-method="initialize"<br> default-destroy-method="destroy"><br><br> <!--<br> This file provisions the IdP with information about the configured login mechanisms available for use.<br> The actual beans and subflows that make up those mechanisms are in their own files, but this pulls them<br> together with deployer-supplied metadata to describe them to the system.<br> <br> You can turn on and off individual mechanisms by adding and remove them here. Nothing left out will<br> be used, regardless any other files loaded by the Spring container.<br> <br> Flow defaults include: no support for IsPassive/ForceAuthn, support for non-browser clients enabled,<br> and default timeout and lifetime values set via properties. We also default to supporting the SAML 1/2<br> expressions for password-based authentication over a secure channel, so anything more exotic requires<br> customization, as the examples below for IP address and SPNEGO authentication illustrate.<br> --><br><br> <util:list id="shibboleth.AvailableAuthenticationFlows"><br> <br> <bean id="authn/IPAddress" parent="shibboleth.AuthenticationFlow"<br> p:passiveAuthenticationSupported="true"<br> p:lifetime="PT60S" p:inactivityTimeout="PT60S"><br> <property name="supportedPrincipals"><br> <list><br> <bean parent="shibboleth.SAML2AuthnContextClassRef"<br> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocol" /><br> </list><br> </property><br> </bean><br><br> <bean id="authn/SPNEGO" parent="shibboleth.AuthenticationFlow"<br> p:nonBrowserSupported="false"><br> <property name="supportedPrincipals"><br> <list><br> <bean parent="shibboleth.SAML2AuthnContextClassRef"<br> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:Kerberos" /><br> <bean parent="shibboleth.SAML1AuthenticationMethod"<br> c:method="urn:ietf:rfc:1510" /><br> </list><br> </property><br> </bean><br> <br> <bean id="authn/External" parent="shibboleth.AuthenticationFlow"<br> p:nonBrowserSupported="false" /><br><br> <bean id="authn/RemoteUser" parent="shibboleth.AuthenticationFlow"<br> p:nonBrowserSupported="false" /><br><br> <bean id="authn/RemoteUserInternal" parent="shibboleth.AuthenticationFlow" /><br><br> <bean id="authn/Function" parent="shibboleth.AuthenticationFlow" /><br><br> <bean id="authn/X509" parent="shibboleth.AuthenticationFlow"<br> p:nonBrowserSupported="false"><br> <property name="supportedPrincipals"><br> <list><br> <bean parent="shibboleth.SAML2AuthnContextClassRef"<br> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:X509" /><br> <bean parent="shibboleth.SAML2AuthnContextClassRef"<br> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient" /><br> <bean parent="shibboleth.SAML1AuthenticationMethod"<br> c:method="urn:ietf:rfc:2246" /><br> </list><br> </property><br> </bean><br><br> <bean id="authn/X509Internal" parent="shibboleth.AuthenticationFlow"><br> <property name="supportedPrincipals"><br> <list><br> <bean parent="shibboleth.SAML2AuthnContextClassRef"<br> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:X509" /><br> <bean parent="shibboleth.SAML2AuthnContextClassRef"<br> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient" /><br> <bean parent="shibboleth.SAML1AuthenticationMethod"<br> c:method="urn:ietf:rfc:2246" /><br> </list><br> </property><br> </bean><br><br> <bean id="authn/Password" parent="shibboleth.AuthenticationFlow"<br> p:passiveAuthenticationSupported="true"<br> p:forcedAuthenticationSupported="true" /><br><br> <bean id="authn/Duo" parent="shibboleth.AuthenticationFlow"<br> p:forcedAuthenticationSupported="true"<br> p:nonBrowserSupported="false"><br> <!--<br> The list below should be changed to reflect whatever locally- or<br> community-defined values are appropriate to represent MFA. It is<br> strongly advised that the value not be specific to Duo or any<br> particular technology.<br> --><br> <property name="supportedPrincipals"><br> <list><br> <bean parent="shibboleth.SAML2AuthnContextClassRef"<br> c:classRef="<a href="http://example.org/ac/classes/mfa">http://example.org/ac/classes/mfa</a>" /><br> <bean parent="shibboleth.SAML1AuthenticationMethod"<br> c:method="<a href="http://example.org/ac/classes/mfa">http://example.org/ac/classes/mfa</a>" /><br> </list><br> </property><br> </bean><br><br> <bean id="authn/MFA" parent="shibboleth.AuthenticationFlow"<br> p:passiveAuthenticationSupported="true"<br> p:forcedAuthenticationSupported="true"><br> <!--<br> The list below almost certainly requires changes, and should generally be the<br> union of any of the separate factors you combine in your particular MFA flow<br> rules. The example corresponds to the example in mfa-authn-config.xml that<br> combines IPAddress with Password.<br> --><br> <property name="supportedPrincipals"><br> <list><br> <bean parent="shibboleth.SAML2AuthnContextClassRef"<br> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocol" /><br> <bean parent="shibboleth.SAML2AuthnContextClassRef"<br> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" /><br> <bean parent="shibboleth.SAML2AuthnContextClassRef"<br> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:Password" /><br> <bean parent="shibboleth.SAML1AuthenticationMethod"<br> c:method="urn:oasis:names:tc:SAML:1.0:am:password" /><br> </list><br> </property><br> </bean><br><br> </util:list><br><br> <!--<br> This is a map used to "weight" particular methods above others if the IdP has to randomly select one<br> to insert into a SAML authentication statement. The typical use shown below is to bias the IdP in favor<br> of expressing the SAML 2 PasswordProtectedTransport class over the more vanilla Password class on the<br> assumption that the IdP doesn't accept passwords via an insecure channel. This map never causes the IdP<br> to violate its matching rules if an RP requests a particular value; it only matters when nothing specific<br> is chosen. Anything not in the map has a weight of zero.<br> --><br> <br> <util:map id="shibboleth.AuthenticationPrincipalWeightMap"><br> <entry><br> <key><br> <bean parent="shibboleth.SAML2AuthnContextClassRef"<br> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" /><br> </key><br> <value>1</value><br> </entry><br> </util:map><br><br></beans></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, 11 Feb 2020 at 15:51, Cantor, Scott <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">> What could be something missed we could look at?<br>
<br>
Perhaps you didn't configure the MFA method or one of the underlying factors as supporting non-browser access in general-authn.xml, but it defaults to supporting it so that would require a deliberate change. You have to break it to stop it from working, more or less.<br>
<br>
-- Scott<br>
<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>