<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hi,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Shibboleth IdP 3.4.7</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
We've implemented a conditional MFA flow that utilises SPENGO (if available) or Password (if not), then Duo as the 2nd factor. We enable only the MFA flow, use shibboleth.authn.MFA.TransitionMap with inline scripted conditional logic much like examples throughout
the doco, then force 2nd factor for a single relying party. We also have an activation condition on SPNEGO that limits it to the same relying party. All other SPs continue to use single factor (Password). This all appears to work fine, except for the case
where we login to one of the single factor services first, then attempt to login to the MFA service on a SPNEGO capable client. We can see from the logs that the SPNEGO flow succeeds and is canonicalized just fine. It then proceeds to the Duo flow, and that
appears to succeed until the post-authentication canonicalization step. Some logs below for reference.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Being very new to the Shibboleth platform and having no one else to lean on, I'm pretty much stuck. I've been pouring over the documentation for days trying to find a solution to this problem, but at this point, I'm really not certain exactly what the problem
is. Is anyone able to shed some light on how to debug this further, or suggest where I should focus my efforts? I'm happy to post some of my configuration snippets if that's required for context.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks,</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Grant</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
</div>
DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:227] - Profile Action TransitionMultiFactorAuthentication: MFA flow transition after 'proceed' event to 'authn/Duo' flow
<div>DEBUG [net.shibboleth.idp.authn.duo.impl.ExtractDuoAuthenticationFromHeaders:189] - Profile Action ExtractDuoAuthenticationFromHeaders: Checking for Duo authentication headers</div>
<div>DEBUG [net.shibboleth.idp.authn.duo.impl.ExtractDuoAuthenticationFromHeaders:200] - Profile Action ExtractDuoAuthenticationFromHeaders: No Duo factor specified, auto method will not be attempted</div>
<div>INFO [net.shibboleth.idp.authn.duo.impl.ValidateDuoWebResponse:200] - Profile Action ValidateDuoWebResponse: Duo authentication succeeded for 'user'</div>
<div>DEBUG [net.shibboleth.idp.authn.AbstractValidationAction:354] - Profile Action ValidateDuoWebResponse: Adding custom Principal(s) defined on underlying flow descriptor</div>
<div>DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:198] - Profile Action TransitionMultiFactorAuthentication: Preserving authentication result from 'authn/Duo' flow</div>
<div>DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:215] - Profile Action TransitionMultiFactorAuthentication: Applying MFA transition rule to exit state 'authn/Duo'</div>
<div>DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:232] - Profile Action TransitionMultiFactorAuthentication: MFA flow completing with event 'proceed'</div>
<div>DEBUG [net.shibboleth.idp.authn.impl.FinalizeMultiFactorAuthentication:193] - Profile Action FinalizeMultiFactorAuthentication: MFA complete, producing merged result</div>
<div>DEBUG [net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext:79] - Profile Action PopulateSubjectCanonicalizationContext: Installing 2 canonicalization flows into SubjectCanonicalizationContext</div>
<div>DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] - Profile Action SelectSubjectCanonicalizationFlow: Checking canonicalization flow c14n/x500 for applicability...</div>
<div>DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:106] - Profile Action SelectSubjectCanonicalizationFlow: Canonicalization flow c14n/x500 was not applicable to this request</div>
<div>DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:100] - Profile Action SelectSubjectCanonicalizationFlow: Checking canonicalization flow c14n/simple for applicability...</div>
<div>DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:106] - Profile Action SelectSubjectCanonicalizationFlow: Canonicalization flow c14n/simple was not applicable to this request</div>
<div>ERROR [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:78] - Profile Action SelectSubjectCanonicalizationFlow: No potential flows left to choose from, canonicalization will fail</div>
<div>INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:138] - Profile Action SelectAuthenticationFlow: Moving incomplete flow authn/MFA to intermediate set</div>
<div>DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:395] - Profile Action SelectAuthenticationFlow: Specific principals requested with 'exact' operator: [AuthnContextClassRefPrincipal{authnContextClassRef=https://refeds.org/profile/mfa}]</div>
<div>DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:507] - Profile Action SelectAuthenticationFlow: Checking for an inactive flow or active result compatible with operator 'exact' and principal 'https://refeds.org/profile/mfa'</div>
<div>DEBUG [net.shibboleth.idp.authn.principal.PrincipalEvalPredicateFactoryRegistry:82] - Registry located predicate factory of type 'net.shibboleth.idp.authn.principal.impl.ExactPrincipalEvalPredicateFactory' for principal type 'class net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal'
and operator 'exact'</div>
<div>INFO [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:539] - Profile Action SelectAuthenticationFlow: None of the potential authentication flows can satisfy the request</div>
<div>WARN [org.opensaml.profile.action.impl.LogEvent:105] - A non-proceed event occurred while processing the request: RequestUnsupported</div>
<div>DEBUG [org.opensaml.saml.common.profile.logic.DefaultLocalErrorPredicate:173] - Error event RequestUnsupported will be handled with response</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
</body>
</html>