<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks. OK, I have MFA working for all SPs by doing this:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
idp.authn.flows= MFA<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
and configuring the appropriate files in the authn directory.</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
So to enable MFA for just one SP (Shibboleth) I do something like this?<br>
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="background-color:rgb(255, 255, 255);display:inline !important">idp.authn.flows= RemoteUser|MFA</span><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<bean parent="RelyingPartyByName" c:relyingPartyIds="https://shibsp-1.uic.edu/shibboleth">
<div> <property name="profileConfigurations"></div>
<div> <list></div>
<div> <bean parent="SAML2.SSO.MDDriven" p:defaultAuthenticationMethods="#{ {'MFA'} }" /></div>
<div> </list></div>
<div> </property></div>
</bean><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
This doesn't work:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
"Profile Action SelectAuthenticationFlow: None of the potential authentication flows can satisfy the request". <br>
</div>
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div></div>
<div id="divtagdefaultwrapper" style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
<div style="font-family:Tahoma; font-size:13px">---
<div><span id="ms-rterangepaste-start"></span><span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Roberto Ullfig - rullfig@uic.edu</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Systems Administrator</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Enterprise Applications & Services | Technology Solutions</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">University of Illinois - Chicago</span>
<div><span id="ms-rterangepaste-end"></span></div>
</div>
</div>
</div>
</div>
</div>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Cantor, Scott <cantor.2@osu.edu><br>
<b>Sent:</b> Thursday, April 22, 2021 1:08 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> RE: Customizing Second Factor Configuration in mfa-authn-config.xml</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">(Example in <a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fdisplay%2FIDP4%2FSAML2SSOConfiguration&data=04%7C01%7Crullfig%40uic.edu%7C3a9ac11f179a4166bef208d905b9a4b9%7Ce202cd477a564baa99e3e3b71a7c77dd%7C0%7C0%7C637547117153627104%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=rpa8Es2rSha3z8JdIwYFrteLQ6Jbei3hZzBHdpN5aF4%3D&reserved=0">
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fdisplay%2FIDP4%2FSAML2SSOConfiguration&data=04%7C01%7Crullfig%40uic.edu%7C3a9ac11f179a4166bef208d905b9a4b9%7Ce202cd477a564baa99e3e3b71a7c77dd%7C0%7C0%7C637547117153627104%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=rpa8Es2rSha3z8JdIwYFrteLQ6Jbei3hZzBHdpN5aF4%3D&reserved=0</a>,
Authentication tab)<br>
<br>
-- Scott<br>
<br>
> -----Original Message-----<br>
> From: Cantor, Scott<br>
> Sent: Thursday, April 22, 2021 2:06 PM<br>
> To: Shib Users <users@shibboleth.net><br>
> Subject: RE: Customizing Second Factor Configuration in mfa-authn-config.xml<br>
> <br>
> > We want to enable Duo for just a few SPs. I believe this needs to be<br>
> > configured in mfa-authn-config.xml in this bean<br>
> <br>
> No. Doing that is handled by attaching supportedPrincipals to an override for<br>
> the RP(s) or via metadata, and then using that to influence the isAcceptable()<br>
> calls in the transition rules.<br>
> <br>
> -- Scott<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=04%7C01%7Crullfig%40uic.edu%7C3a9ac11f179a4166bef208d905b9a4b9%7Ce202cd477a564baa99e3e3b71a7c77dd%7C0%7C0%7C637547117153637055%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=gOOk0OCGJ3%2FS2iW%2B%2B8kzv5k%2FncdP009vgw5rrDViEzE%3D&reserved=0">
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=04%7C01%7Crullfig%40uic.edu%7C3a9ac11f179a4166bef208d905b9a4b9%7Ce202cd477a564baa99e3e3b71a7c77dd%7C0%7C0%7C637547117153637055%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=gOOk0OCGJ3%2FS2iW%2B%2B8kzv5k%2FncdP009vgw5rrDViEzE%3D&reserved=0</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font></div>
</body>
</html>