<div dir="ltr">Hi All,<div><br></div><div>I'm trying to configure Shibboelth v4.0.1 to assert 

<a href="https://refeds.org/profile/mfa">https://refeds.org/profile/mfa</a>

 after a user MFA's via proxy to Azure and am running into some interesting questions.</div><div><br></div><div>I have a semi-working instance of running in development that is doing proxying to Azure using the instructions given at:</div><div><br></div><div><a href="https://wiki.shibboleth.net/confluence/display/KB/Using+SAML+Proxying+in+the+Shibboleth+IdP+to+connect+with+Azure+AD">https://wiki.shibboleth.net/confluence/display/KB/Using+SAML+Proxying+in+the+Shibboleth+IdP+to+connect+with+Azure+AD</a></div><div><br></div><div>(note, some additional work to the Azure metadata and subject-c14n.xml were needed, but not much)<br><br>The issue I'm currently dealing with is that Azure AD doesn't have it clearly documented what AuthnContexts <a href="https://docs.microsoft.com/en-us/azure/active-directory/develop/reference-saml-tokens#claims-in-saml-tokens:~:text=authenticated.-,%3CAuthnContextClassRef%3E,%3C%2FAuthnContextClassRef%3E">one can request from it aside from</a> <br style="box-sizing:inherit;outline-color:inherit;color:rgb(23,23,23);font-family:"Segoe UI",SegoeUI,"Helvetica Neue",Helvetica,Arial,sans-serif;font-size:14px"><code style="box-sizing:inherit;font-family:SFMono-Regular,Consolas,"Liberation Mono",Menlo,Courier,monospace;font-size:11.9px;outline-color:inherit;direction:ltr;padding:0.1em 0.2em;border-radius:3px;word-break:break-all;color:rgb(23,23,23)"><a href="http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod/password">http://schemas.microsoft.com/ws/2008/06/identity/claims/authenticationmethod/password</a></code><br style="box-sizing:inherit;outline-color:inherit;color:rgb(23,23,23);font-family:"Segoe UI",SegoeUI,"Helvetica Neue",Helvetica,Arial,sans-serif;font-size:14px"><br>What Azure seems to do instead is return the above AuthnContext and include an attribute <a href="http://schemas.microsoft.com/claims/authnmethodsreferences">http://schemas.microsoft.com/claims/authnmethodsreferences</a> which returns the various authn's the user performed.  <br><br>The example code in authn-comparison.xml seems to indicate that it'll happily convert between AuthnContexts using shibboleth.<a href="https://wiki.shibboleth.net/confluence/display/IDP4/AuthenticationConfiguration#AuthenticationConfiguration-AuthenticationTypeMapping:~:text=shibboleth.PrincipalProxyResponseMappings">PrincipalProxyResponseMapping</a>s.  Will it also allow AuthnContextClassRef to be influenced by a value returned in the attribute statement?<br><br>For example, if  within the AttributeStatement, an attribute <a href="http://schemas.microsoft.com/claims/authnmethodsreferences">http://schemas.microsoft.com/claims/authnmethodsreferences</a> contained a value <a href="http://schemas.microsoft.com/claims/multipleauthn">http://schemas.microsoft.com/claims/multipleauthn</a>, could one map that to a <a href="https://refeds.org/profile/mfa">https://refeds.org/profile/mfa</a> authnContextClassRef in the AuthnStatement? Or is the mapping more simple than that?<br clear="all"><div><br></div><div>If that's not possible, would it be possible to run a script after the authn/SAML flow that would do the attribute check and update the AuthnContext accordingly?  I've done scripting for determining when to present the Duo iFrame, but I'm not sure if it's possible to replace the AuthnContextClassRef value from a script or not.  </div><div><br></div><div>Thanks!</div>-- <br><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div dir="ltr"><div><div dir="ltr">Jeffrey Williams </div><div dir="ltr">Identity & Access Engineer<br>Identity & Access Services<br><a href="https://its.uncg.edu" target="_blank">https://its.uncg.edu</a></div></div><div dir="ltr"><br></div><div dir="ltr"><img src="https://uncgcdn.blob.core.windows.net/email/UNCGLogo.png"><br></div></div></div></div></div></div></div></div></div></div></div>