<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color:rgb(32, 31, 30);font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:14.6667px;background-color:rgb(255, 255, 255);display:inline !important">>
<bean parent="shibboleth.authn.MFA.Transition" p:nextFlow="authn/RemoteUser" /></span><br>
<br style="color:rgb(32, 31, 30);font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:14.6667px;background-color:rgb(255, 255, 255)">
<span style="color:rgb(32, 31, 30);font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:14.6667px;background-color:rgb(255, 255, 255);display:inline !important">"i.e
there is no way you should have RemoteUser enabled, because you do not want the IdP running it by itself; the MFA logic already runs it when required."</span><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color:rgb(32, 31, 30);font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:14.6667px;background-color:rgb(255, 255, 255);display:inline !important"><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="color:rgb(32, 31, 30);font-family:"Segoe UI", "Segoe UI Web (West European)", "Segoe UI", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;font-size:14.6667px;background-color:rgb(255, 255, 255);display:inline !important">I
don't understand this response. We use RemoteUser instead of Password. The original example uses IPAddress and Password and there's mention of replacing this with Password and Duo - why would we not use RemoteUser and Duo then?</span></div>
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div></div>
<div id="divtagdefaultwrapper" style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
<div style="font-family:Tahoma; font-size:13px">---
<div><span id="ms-rterangepaste-start"></span><span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Roberto Ullfig - rullfig@uic.edu</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Systems Administrator</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Enterprise Applications & Services | Technology Solutions</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">University of Illinois - Chicago</span>
<div><span id="ms-rterangepaste-end"></span></div>
</div>
</div>
</div>
</div>
</div>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Cantor, Scott <cantor.2@osu.edu><br>
<b>Sent:</b> Monday, April 26, 2021 12:47 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: SP Requiring/Requesting MFA (was Re: Customizing Second Factor Configuration in mfa-authn-config.xml)</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">On 4/26/21, 1:24 PM, "users on behalf of Ullfig, Roberto Alfredo" <users-bounces@shibboleth.net on behalf of rullfig@uic.edu> wrote:<br>
<br>
> OK then, to NOT do this globally, I define the supported authn in relying-party.xml under<br>
> DefaultRelyingParty? Here are some of the important bits:<br>
<br>
The DefaultRelyingParty settings are global, overrides are non-global, as are metadata-driven settings when that's done in place of putting them in the central file.<br>
<br>
> idp.authn.flows= RemoteUser|MFA<br>
<br>
As the documentation notes, MFA generally stands alone. If it's enabled, nothing else generally is, or at least nothing that it directly controls/directs the use of. I doubt very seriously you want both enabled, and that will do very surprising things at times,
if not outright broken ones.<br>
<br>
> <bean parent="shibboleth.authn.MFA.Transition" p:nextFlow="authn/RemoteUser" /><br>
<br>
i.e there is no way you should have RemoteUser enabled, because you do not want the IdP running it by itself; the MFA logic already runs it when required.<br>
<br>
> I still have the same issue with the SP requesting mfa (the one I earlier posted the authn request) as it is here<br>
> - in this case mfa is done. When I try to force it to Password with SAML2.SSO.FEATURE_AUTHNCONTEXT I get:<br>
<br>
You didn't indicate what the issue was originally, but no, you can't do that globally without issues. If you try and globally block requests like that, you're going to break stuff.<br>
<br>
If you explicitly enable MFA for some SP using the IdP to do it, then by definition you know it shouldn't be requesting anything and it's safe to block the feature for that SP. Globally? No, that doesn't work.<br>
<br>
You can, at best, audit everything over time, find all the systems that are requesting something and either get them to stop or create an override that's inverted (every SP *but* the outliers).<br>
<br>
Until that point, enabling MFA would have to be a per-SP setting, or handled more effectively, a metadata-driven setting using a tag attached to the metadata. Or literally two metadata-driven settings to actually control the defaultAuthenticationMethods and
disallowedFeatures settings from metadata, which is what I do personally.<br>
<br>
-- Scott<br>
<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=04%7C01%7Crullfig%40uic.edu%7C87a41b5811544639441508d908db6137%7Ce202cd477a564baa99e3e3b71a7c77dd%7C0%7C0%7C637550560579381041%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=4B%2F47n0j9zjjYYq0JjkLtdBkSzF6hh95nl1Dc9qSU54%3D&reserved=0">
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=04%7C01%7Crullfig%40uic.edu%7C87a41b5811544639441508d908db6137%7Ce202cd477a564baa99e3e3b71a7c77dd%7C0%7C0%7C637550560579381041%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=4B%2F47n0j9zjjYYq0JjkLtdBkSzF6hh95nl1Dc9qSU54%3D&reserved=0</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font></div>
</body>
</html>