<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
OK then, to NOT do this globally, I define the supported authn in relying-party.xml under DefaultRelyingParty? Here are some of the important bits:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
idp.properties:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
idp.authn.flows= RemoteUser|MFA<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
general-authn.xml:<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<bean id="authn/RemoteUser" parent="shibboleth.AuthenticationFlow"
<div> p:forcedAuthenticationSupported="true"</div>
p:nonBrowserSupported="false" /><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<bean id="authn/Duo" parent="shibboleth.AuthenticationFlow"
<div> p:forcedAuthenticationSupported="true"</div>
<div> p:nonBrowserSupported="false"></div>
<div><br>
</div>
<div> <property name="supportedPrincipals"></div>
<div> <list></div>
<div> <bean parent="shibboleth.SAML2AuthnContextClassRef"</div>
<div> c:classRef="https://refeds.org/profile/mfa" /></div>
<div> <bean parent="shibboleth.SAML1AuthenticationMethod"</div>
<div> c:method="https://refeds.org/profile/mfa" /></div>
<div> </list></div>
<div> </property></div>
</bean><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<bean id="authn/MFA" parent="shibboleth.AuthenticationFlow"
<div> p:passiveAuthenticationSupported="true"</div>
<div> p:forcedAuthenticationSupported="true"></div>
<div><br>
</div>
<div> <property name="supportedPrincipals"></div>
<div> <list></div>
<div> <bean parent="shibboleth.SAML2AuthnContextClassRef"</div>
<div> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" /></div>
<div> <bean parent="shibboleth.SAML2AuthnContextClassRef"</div>
<div> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:Password" /></div>
<div> <bean parent="shibboleth.SAML1AuthenticationMethod"</div>
<div> c:method="urn:oasis:names:tc:SAML:1.0:am:password" /></div>
<div> <bean parent="shibboleth.SAML2AuthnContextClassRef"</div>
<div> c:classRef="https://refeds.org/profile/mfa" /></div>
<div> <bean parent="shibboleth.SAML1AuthenticationMethod"</div>
<div> c:method="https://refeds.org/profile/mfa" /></div>
<div> </list></div>
<div> </property></div>
</bean><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
mfa-authn-config.xml:<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<util:map id="shibboleth.authn.MFA.TransitionMap">
<div> <entry key=""></div>
<div> <bean parent="shibboleth.authn.MFA.Transition" p:nextFlow="authn/RemoteUser" /></div>
<div> </entry></div>
<div> <entry key="authn/RemoteUser"></div>
<div> <bean parent="shibboleth.authn.MFA.Transition" p:nextFlowStrategy-ref="checkSecondFactor" /></div>
<div> </entry></div>
<div> <!-- An implicit final rule will return whatever the final flow returns. --></div>
</util:map><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<bean id="checkSecondFactor" parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript"
<div> p:customObject-ref="shibboleth.AttributeResolverService"></div>
<div> <constructor-arg></div>
<div> <value></div>
<div> <![CDATA[</div>
<div> nextFlow = "authn/Duo";</div>
<div><br>
</div>
<div> // Go straight to second factor if we have to, or set up for an attribute lookup first.</div>
<div> authCtx = input.getSubcontext("net.shibboleth.idp.authn.context.AuthenticationContext");</div>
<div> mfaCtx = authCtx.getSubcontext("net.shibboleth.idp.authn.context.MultiFactorAuthenticationContext");</div>
<div> if (mfaCtx.isAcceptable()) {</div>
<div> // Attribute check is required to decide if first factor alone is enough.</div>
<div> resCtx = input.getSubcontext(</div>
<div> "net.shibboleth.idp.attribute.resolver.context.AttributeResolutionContext", true);</div>
<div><br>
</div>
<div> // Look up the username using a standard function.</div>
<div> usernameLookupStrategyClass</div>
<div> = Java.type("net.shibboleth.idp.session.context.navigate.CanonicalUsernameLookupStrategy");</div>
<div> usernameLookupStrategy = new usernameLookupStrategyClass();</div>
<div> resCtx.setPrincipal(usernameLookupStrategy.apply(input));</div>
<div><br>
</div>
<div> resCtx.getRequestedIdPAttributeNames().add("allowedLoginMethods");</div>
<div> resCtx.resolveAttributes(custom);</div>
<div><br>
</div>
<div> // Check for an attribute that authorizes use of first factor.</div>
<div> attribute = resCtx.getResolvedIdPAttributes().get("allowedLoginMethods");</div>
<div> valueType = Java.type("net.shibboleth.idp.attribute.StringAttributeValue");</div>
<div> if (attribute != null && attribute.getValues().contains(new valueType("IPAddress"))) {</div>
<div> nextFlow = null;</div>
<div> }</div>
<div><br>
</div>
<div> input.removeSubcontext(resCtx); // cleanup</div>
<div> }</div>
<div><br>
</div>
<div> nextFlow; // pass control to second factor or end with the first</div>
<div> ]]></div>
<div> </value></div>
<div> </constructor-arg></div>
</bean><br>
</div>
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
relying-party.xml:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<bean id="MFASAML2Principal" parent="shibboleth.SAML2AuthnContextClassRef" c:_0="https://refeds.org/profile/mfa" />
<div> <bean id="Password1" parent="shibboleth.SAML2AuthnContextClassRef" c:_0="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" /></div>
<div> <bean id="Password2" parent="shibboleth.SAML2AuthnContextClassRef" c:_0="urn:oasis:names:tc:SAML:2.0:ac:classes:Password" /></div>
<div> <bean id="Password3" parent="shibboleth.SAML1AuthenticationMethod" c:_0="urn:oasis:names:tc:SAML:1.0:am:password" /></div>
<div><br>
</div>
<div> <!--</div>
<div> Default configuration, with default settings applied for all profiles, and enables</div>
<div> the attribute-release consent flow.</div>
<div> --></div>
<div> <bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty"></div>
<div> <property name="profileConfigurations"></div>
<div> <list></div>
<div> <bean parent="Shibboleth.SSO" /></div>
<div> <ref bean="SAML1.AttributeQuery" /></div>
<div> <ref bean="SAML1.ArtifactResolution" /></div>
<div> <bean parent="SAML2.SSO.MDDriven" p:postAuthenticationFlows="#{ {'terms-of-use'} }" /></div>
<div> <ref bean="SAML2.ECP" /></div>
<div> <ref bean="SAML2.Logout" /></div>
<div> <ref bean="SAML2.AttributeQuery" /></div>
<div> <ref bean="SAML2.ArtifactResolution" /></div>
<div> <ref bean="Liberty.SSOS" /></div>
<div><!--</div>
<div> <bean parent="SAML2.SSO" p:disallowedFeatures-ref="SAML2.SSO.FEATURE_AUTHNCONTEXT"></div>
<div>--></div>
<div> <bean parent="SAML2.SSO"></div>
<div> <property name="defaultAuthenticationMethods"></div>
<div> <list></div>
<div> <ref bean="Password1" /></div>
<div> <ref bean="Password2" /></div>
<div> </list></div>
<div> </property></div>
<div> </bean></div>
<div> </list></div>
<div> </property></div>
</bean><br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I still have the same issue with the SP requesting mfa (the one I earlier posted the authn request) as it is here - in this case mfa is done. When I try to force it to Password with <span style="background-color:rgb(255, 255, 255);display:inline !important">SAML2.SSO.FEATURE_AUTHNCONTEXT
I get:</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="background-color:rgb(255, 255, 255);display:inline !important"><br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<span style="background-color:rgb(255, 255, 255);display:inline !important">2021-04-26 12:20:19,638 - WARN [net.shibboleth.idp.saml.saml2.profile.impl.ProcessRequestedAuthnContext:206] - [9629B65150B337B861D5B9AB63CEC082] - [128.248.2.59] - Profile Action ProcessRequestedAuthnContext:
Incoming RequestedAuthnContext disallowed by profile configuration2021-04-26 12:20:19,638 - WARN [org.opensaml.profile.action.impl.LogEvent:101] - [9629B65150B337B861D5B9AB63CEC082] - [128.248.2.59] - A non-proceed event occurred while processing the request:
AccessDenied<br>
</span></div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div></div>
<div id="divtagdefaultwrapper" style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
<div style="font-family:Tahoma; font-size:13px">---
<div><span id="ms-rterangepaste-start"></span><span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Roberto Ullfig - rullfig@uic.edu</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Systems Administrator</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Enterprise Applications & Services | Technology Solutions</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">University of Illinois - Chicago</span>
<div><span id="ms-rterangepaste-end"></span></div>
</div>
</div>
</div>
</div>
</div>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Cantor, Scott <cantor.2@osu.edu><br>
<b>Sent:</b> Monday, April 26, 2021 10:54 AM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: SP Requiring/Requesting MFA (was Re: Customizing Second Factor Configuration in mfa-authn-config.xml)</font>
<div> </div>
</div>
<div class="BodyFragment"><font size="2"><span style="font-size:11pt;">
<div class="PlainText">On 4/26/21, 11:49 AM, "users on behalf of Ullfig, Roberto Alfredo" <users-bounces@shibboleth.net on behalf of rullfig@uic.edu> wrote:<br>
<br>
> OK, this SP is sending this:<br>
<br>
That doesn't really tell me what it is your IdP is actually programmed to do, but the example material would result in such an IdP honoring first-factor-only both initially and on reuse because the SP is saying that password alone is just fine. Order rarely
matters in these cases unless there are very separate and discrete mechanisms in play. Duo doesn't work like that, it's piggybacking on something else.<br>
<br>
>If it's not available it ends up using urn:oasis:names:tc:SAML:2.0:ac:classes:Password - But there's nothing in<br>
> this SP's metadata indicating this.<br>
<br>
There is no such metadata to indicate it.<br>
<br>
> The problem here is that if we enable MFA, we can't determine which SPs are passing this authncontext so<br>
> we don't know which applications will be impacted by our change - unless we enable debug mode for a period<br>
> of time and check our logs.<br>
<br>
Or you don't do anything globally. But yes, that's true. If you want to know what something is doing, you have to log it. I'm not sure why that would be a revelation or why it's an issue.<br>
<br>
As for the logging, no, you don't do it on DEBUG and just look at XML, you audit it. Requested AuthnContext content can be added to the audit log.<br>
<br>
-- Scott<br>
<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=04%7C01%7Crullfig%40uic.edu%7C35ebe68ea76940b32c3008d908cb9ad1%7Ce202cd477a564baa99e3e3b71a7c77dd%7C0%7C0%7C637550492843800802%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=ws5QSNBwyLQT5ScPz40ghN6PdDU3UadD41qEOWcwv0g%3D&reserved=0">
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=04%7C01%7Crullfig%40uic.edu%7C35ebe68ea76940b32c3008d908cb9ad1%7Ce202cd477a564baa99e3e3b71a7c77dd%7C0%7C0%7C637550492843800802%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=ws5QSNBwyLQT5ScPz40ghN6PdDU3UadD41qEOWcwv0g%3D&reserved=0</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font></div>
</body>
</html>