<div dir="ltr"><div>I appreciate the help but the more I hear about all of this SAML and SpringWebFlows, the more I think I'm messing this up or missing some important information.</div><div><br></div><div>I kept receiving errors that stated my relying-party.xml was misconfigured but they provided little more info than that. Something about SAML binds. I was getting mixed up with my changes so I decided to restart from my backup. At the moment, I have a duo.properties with the correct keys and api-host (verified through CAS). I have a general-authn.xml with default entries for duo and mfa (1 below), a default mfa-authn-config.xml, the relying-party.xml has a default profile configuration (2 below) with what seems like overrides for every service related to emailAddress.</div><div><br></div><div>Points of confusion:</div><div>"define something to represent this mechanism to the outside "SAML" world as an authentication context class by adjusting the <code>supportedPrincipals</code> property on the Duo (and probably MFA) flow descriptors in <em>conf/authn/general-authn.xml</em>." from <a href="https://wiki.shibboleth.net/confluence/display/IDP4/DuoAuthnConfiguration">https://wiki.shibboleth.net/confluence/display/IDP4/DuoAuthnConfiguration</a>. I thought I could use Stanford Universities MFA context (<a href="https://uit.stanford.edu/service/saml/profile/mfa/forced">https://uit.stanford.edu/service/saml/profile/mfa/forced</a>) as it seemed like it would be a good fit, however they mentioned those profiles were for SPs so I wasn't sure if I could even implement them. I attempted anyway with the following bean within the supportedPrincipals of the default authn/Duo mechanism: <bean parent="shibboleth.SAML2AuthnContextClassRef" c:classRef="<a href="https://saml.stanford.edu/profile/mfa/forced">https://saml.stanford.edu/profile/mfa/forced</a>" />. I'm not sure if this will even work, I will reiterate that I have little experience with Java and xml and no experience with the Spring WebFlow.</div><div><br></div><div>Should I be configuring some sort of script within the mfa-authn-config.xml script? Prior to this upgrade we were running shibboleth 3.1.2, which didn't even support multifactor from what I understand, so I'm not sure how mfa factors in to this whole situation. We only needed username and password authentication at that time. This single-factor authentication still works after the upgrade to shibboleth 4.0. Am I supposed to configure MFA to override the single factor username to allow for multiple forms of authentication? I have no Idea how this works and while reading the shibboleth documentation I find myself more confused than when I started. <br></div><div><br></div><div>How does the ProfileConfiguration-Authentication link provided in the last email fit in with the relying-party.xml configuration I have in (2)? If I try to define the default auth method for a specific service provider, I was able to sign in to the service with only my username and password (no Duo enrollment or prompt) or I was met with another generic "relying-party.xml misconfiguration" error.</div><div><br></div><div>All I want is to sign in to one particular service provider with username and password, then be prompted to authenticate through Duo, and be brought back to my service if all goes well. I apologize for being so brash, but I don't have the time to become a spring developer and those who set this system up have left my place of business, taking their experience with them.</div><div><br></div><div>As usual, help is appreciated, but if what I ask is beyond the scope of this email list please refer me to another group.<br></div><div><br></div><div>(1.)general-authn.xml:</div><div><bean id="authn/Duo" parent="shibboleth.AuthenticationFlow"<br> p:forcedAuthenticationSupported="true"<br> p:nonBrowserSupported="false"><br> <!--<br> The list below should be changed to reflect whatever locally- or<br> community-defined values are appropriate to represent MFA. It is<br> strongly advised that the value not be specific to Duo or any<br> particular technology.<br> --><br> <property name="supportedPrincipals"><br> <list><br> <bean parent="shibboleth.SAML2AuthnContextClassRef"<br> c:classRef="<a href="http://example.org/ac/classes/mfa">http://example.org/ac/classes/mfa</a>" /><br> <bean parent="shibboleth.SAML1AuthenticationMethod"<br> c:method="<a href="http://example.org/ac/classes/mfa">http://example.org/ac/classes/mfa</a>" /><br> </list><br> </property><br> </bean><br><br> <bean id="authn/MFA" parent="shibboleth.AuthenticationFlow"<br> p:passiveAuthenticationSupported="true"<br> p:forcedAuthenticationSupported="true"><br> <!--<br> The list below almost certainly requires changes, and should generally be the<br> union of any of the separate factors you combine in your particular MFA flow<br> rules. The example corresponds to the example in mfa-authn-config.xml that<br> combines IPAddress with Password.<br> --><br> <property name="supportedPrincipals"><br> <list><br> <bean parent="shibboleth.SAML2AuthnContextClassRef"<br> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:InternetProtocol" /><br> <bean parent="shibboleth.SAML2AuthnContextClassRef"<br> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" /><br> <bean parent="shibboleth.SAML2AuthnContextClassRef"<br> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:Password" /><br> <bean parent="shibboleth.SAML1AuthenticationMethod"<br> c:method="urn:oasis:names:tc:SAML:1.0:am:password" /><br> </list><br> </property><br> </bean></div><div><br></div><div>(2.) relying-party.xml:</div><div><!--<br> Default configuration, with default settings applied for all profiles, and enables<br> the attribute-release consent flow.<br> --><br> <bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty"><br> <property name="profileConfigurations"><br> <list><br> <bean parent="Shibboleth.SSO" /><br> <ref bean="SAML1.AttributeQuery" /><br> <ref bean="SAML1.ArtifactResolution" /><br> <bean parent="SAML2.SSO" /><br> <ref bean="SAML2.ECP" /><br> <ref bean="SAML2.Logout" /><br> <ref bean="SAML2.AttributeQuery" /><br> <ref bean="SAML2.ArtifactResolution" /><br> </list><br> </property><br> </bean></div><div><br></div><div> <bean parent="RelyingPartyByName" c:relyingPartyIds="SP's Entity-ID"><br> <property name="profileConfigurations"><br> <list><br> <bean parent="Shibboleth.SSO" p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" /><br> <bean parent="SAML2.SSO" p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress" /><br> </list><br> </property><br> </bean></div><div><br></div><div><br></div><div><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div><div><div dir="ltr"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr">-Jeremiah Garmatter, Systems Administrator<br></div><div>-Ohio Northern University, Class of 2020<br></div><div>-<a href="mailto:j-garmatter@onu.edu" target="_blank">j-garmatter@onu.edu</a></div></div></div></div></div></div></div></div></div></div></div></div></div></div></div><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Jul 27, 2020 at 4:09 PM Cantor, Scott <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">On 7/27/20, 3:43 PM, "users on behalf of Jeremiah Garmatter" <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a> on behalf of <a href="mailto:j-garmatter@onu.edu" target="_blank">j-garmatter@onu.edu</a>> wrote:<br>
<br>
>I'm still confused about the services though. I looked into the relying-parties.xml and found that my predecessors<br>
> included some profile configurations for most of the services. An example of one is included:<br>
<br>
The SAML2.SSO bean has a lot of other settings. One of them is defaultAuthenticationMethods. All the profiles that involve a user logging in have that property.<br>
<br>
<a href="https://wiki.shibboleth.net/confluence/display/IDP4/ProfileConfiguration-Authentication" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/display/IDP4/ProfileConfiguration-Authentication</a><br>
<br>
Second example is what you're asking about.<br>
<br>
> Would I simply have to create a new bean with the parent=shibboleth.SAML2AuthnContextClassRef passing in a class<br>
> reference to my mfa method within the profileConfigurations property?<br>
<br>
Sort of, but the example includes the right syntax (or one syntax among a dozen that are equivalent in Spring).<br>
<br>
-- Scott<br>
<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://wiki.shibboleth.net/confluence/x/coFAAg" rel="noreferrer" target="_blank">https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>