<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Via metadata-driven configuration, by adding this to the metadata for the SP:</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<Extensions>
<div> <mdattr:EntityAttributes></div>
<div> <saml:Attribute Name="http://shibboleth.net/ns/profiles/defaultAuthenticationMethods"</div>
<div> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"></div>
<div> <saml:AttributeValue>https://refeds.org/profile/mfa</saml:AttributeValue></div>
<div> </saml:Attribute></div>
<div> <!-- The disallowedFeatures setting is a bitmask, and 0x1 blocks SPs requesting authentication types. --></div>
<div> <saml:Attribute Name="http://shibboleth.net/ns/profiles/disallowedFeatures"</div>
<div> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"></div>
<div> <saml:AttributeValue>0x1</saml:AttributeValue></div>
<div> </saml:Attribute></div>
<div> </mdattr:EntityAttributes></div>
<span> </Extensions></span></div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
If you need to do it via relying-party.xml, just list only the MFA principal bean as allowed. Here is an example:</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<!-- MFA authenticationContextClass setup -->
<div> <bean id="MFASAML2Principal" parent="shibboleth.SAML2AuthnContextClassRef" c:classRef="https://refeds.org/profile/mfa" /></div>
<span></span></div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<!-- Require Duo -->
<div> <bean parent="RelyingPartyByName" c:relyingPartyIds="#{{'<entityID1>', '<entityID2>'}}"></div>
<div> <property name="profileConfigurations"></div>
<div> <list></div>
<div> <bean parent="SAML2.SSO" p:disallowedFeatures-ref="SAML2.SSO.FEATURE_AUTHNCONTEXT" p:postAuthenticationFlows="#{{'context-check'}}"></div>
<div> <property name="defaultAuthenticationMethods"></div>
<div> <list></div>
<div> <ref bean="MFASAML2Principal" /></div>
<div> </list></div>
<div> </property></div>
<div> </bean></div>
<div> </list></div>
<div> </property></div>
<span> </bean></span><br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div>
<div id="appendonsend"></div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Thanks,</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Andy<br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Ullfig, Roberto Alfredo <rullfig@uic.edu><br>
<b>Sent:</b> Friday, May 14, 2021 1:26 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: SP Requiring/Requesting MFA (was Re: Customizing Second Factor Configuration in mfa-authn-config.xml)</font>
<div> </div>
</div>
<div dir="ltr">
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;">
<span style="color:#D73F09">[This email originated from outside of OSU. Use caution with links and attachments.]</span></p>
<div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Hello Andy, how exactly do you force MFA via metadata?</div>
<div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div id="x_Signature">
<div>
<div></div>
<div id="x_divtagdefaultwrapper" style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
<div style="font-family:Tahoma; font-size:13px">---
<div><span id="x_ms-rterangepaste-start"></span><span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Roberto Ullfig - rullfig@uic.edu</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Systems Administrator</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Enterprise Applications & Services | Technology Solutions</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">University of Illinois - Chicago</span>
<div><span id="x_ms-rterangepaste-end"></span></div>
</div>
</div>
</div>
</div>
</div>
</div>
<div id="x_appendonsend"></div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Andrew Jason Morgan <morgan@oregonstate.edu><br>
<b>Sent:</b> Friday, May 14, 2021 3:16 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: SP Requiring/Requesting MFA (was Re: Customizing Second Factor Configuration in mfa-authn-config.xml)</font>
<div> </div>
</div>
<div dir="ltr">
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Roberto,</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Our IDP uses the following MFA logic:</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<ul>
<li><span>If the SP requests MFA or we force MFA via metadata, perform MFA (or return a SAML error if the user cannot MFA)</span></li><li><span>If the SP requests PasswordProtectedTransport or does not specify an authncontextclass:</span></li><ul>
<li><span>If the user is enrolled in Duo, perform MFA</span></li><li><span>If the user is not enrolled in Duo, no not perform MFA</span></li></ul>
</ul>
<div>Basically, we make our users MFA all the time if they are enrolled in Duo. We also force most of our users to enroll in Duo. Only early admits are excluded from mandatory enrollment.</div>
<div><br>
</div>
<div>Do you need help configuring your IDP as described above, assuming that is your goal?</div>
<div><br>
</div>
<div>Thanks,<br>
</div>
<div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div id="x_x_Signature">
<div>
<div></div>
<div></div>
<div></div>
<div><span style="font-family:Arial,Helvetica,sans-serif; font-size:12pt">Andy Morgan, Identity & Access Management, IT Operations and Identity</span></div>
<div><span style="font-family:Arial,Helvetica,sans-serif; font-size:12pt">Oregon State University | University Information and Technology | 541-737-8877</span><span style="font-family:Verdana,Geneva,sans-serif; font-size:11pt"><br>
</span></div>
</div>
</div>
</div>
</div>
<div>
<div id="x_x_appendonsend"></div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_x_divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Ullfig, Roberto Alfredo <rullfig@uic.edu><br>
<b>Sent:</b> Friday, May 14, 2021 1:05 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: SP Requiring/Requesting MFA (was Re: Customizing Second Factor Configuration in mfa-authn-config.xml)</font>
<div> </div>
</div>
<div dir="ltr">
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin-top:0px; margin-bottom:0px">
<span style="color:#D73F09">[This email originated from outside of OSU. Use caution with links and attachments.]</span></p>
<div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Is this an accurate summation of MFA/Password selection?</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span style="margin:0px; font-size:12pt; color:black; background-color:rgb(255,255,255)"><span style="margin:0px">The attacker (that knows the password) can send a non-MFA Authn request (like Password) to the IDP and the IDP must accept it or reject it. If
accepted, the attacker is in without MFA (Scenario Three below), if rejected SSO just breaks (Scenario One below).</span></span>
<div style="margin:0px; font-size:12pt; color:black; background-color:rgb(255,255,255)">
<br>
</div>
<div style="margin:0px; font-size:12pt; color:black; background-color:rgb(255,255,255)">
scenarios:</div>
<div style="margin:0px; font-size:12pt; color:black; background-color:rgb(255,255,255)">
<br>
</div>
<div style="margin:0px; font-size:12pt; color:black; background-color:rgb(255,255,255)">
One:</div>
<div style="margin:0px; font-size:12pt; color:black; background-color:rgb(255,255,255)">
<ol>
<li><span style="margin:0px">SP sends authn request (MFA or Password) to IDP</span></li><li><span style="margin:0px">IDP rejects authn request</span></li><li>There is no SSO</li></ol>
<div style="margin:0px">Two:</div>
<ol start="4">
<li><span style="margin:0px"><span style="margin:0px; background-color:white">SP sends authn (MFA) request to IDP</span></span></li><li><span style="margin:0px"><span style="margin:0px">IDP accepts authn request</span><br>
</span></li><li>SSO with MFA</li></ol>
<div style="margin:0px">Three:</div>
<div style="margin:0px"></div>
<div style="margin:0px">
<ol>
<li><span style="margin:0px"><span style="margin:0px; background-color:white">SP sends authn (Password) request to IDP</span><br>
</span></li><li><span style="margin:0px"><span style="margin:0px; background-color:white"><span style="margin:0px"><span style="margin:0px">IDP accepts authn request</span></span><br>
</span></span></li><li><span style="margin:0px"><span style="margin:0px; background-color:white"><span style="margin:0px"><span style="margin:0px">SSO without MFA</span></span></span></span></li></ol>
<div style="margin:0px"><span style="margin:0px"><span style="margin:0px; background-color:white"><span style="margin:0px"><span style="margin:0px">Four</span></span></span></span></div>
</div>
<div style="margin:0px">
<ol>
<li><span style="margin:0px"><span style="margin:0px; background-color:white"><span style="margin:0px"><span style="margin:0px">SP does NOT send authn request to IDP</span></span></span></span></li><li><span style="margin:0px"><span style="margin:0px; background-color:white"><span style="margin:0px"><span style="margin:0px">IDP does whatever it wants (Password or MFA) - this is when we can force it to MFA</span></span></span></span></li></ol>
<div style="margin:0px"><span style="margin:0px"><span style="margin:0px; background-color:white"><span style="margin:0px"><span style="margin:0px"><br>
</span></span></span></span></div>
</div>
<div style="margin:0px"><span style="margin:0px"><span style="margin:0px; background-color:white"><span style="margin:0px"><span style="margin:0px">ITrust Federation Manager for some reason is sending BOTH MFA and Password authn requests so what's used by the
IDP is undefined but it looks like our IDP is just using the last one sent which is Password because that's what's being used.</span></span></span></span></div>
<div style="margin:0px"><span style="margin:0px"><span style="margin:0px; background-color:white"><span style="margin:0px"><span style="margin:0px"><br>
</span></span></span></span></div>
<span style="margin:0px"><span style="margin:0px"><span style="margin:0px; background-color:white"><span style="margin:0px"><span style="margin:0px">The authn request always has priority over anything that we have configured for that SP. If we accept the authn
request the IDP must do what the SP requests. If we reject it, there is no SSO.</span></span></span></span></span></div>
<div style="margin:0px; font-size:12pt; color:black; background-color:rgb(255,255,255)">
<span style="margin:0px"><span style="margin:0px"><span style="margin:0px; background-color:white"><span style="margin:0px"><span style="margin:0px"><br>
</span></span></span></span></span></div>
<div style="margin:0px; font-size:12pt; color:black; background-color:rgb(255,255,255)">
<span style="margin:0px"><span style="margin:0px"><span style="margin:0px; background-color:white"><span style="margin:0px"><span style="margin:0px">Finally, Scenario Four is not the best solution, the better solution is to control MFA via metadata.</span></span></span></span></span></div>
<br>
</div>
<div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div id="x_x_x_Signature">
<div>
<div></div>
<div id="x_x_x_divtagdefaultwrapper" style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
<div style="font-family:Tahoma; font-size:13px">---
<div><span id="x_x_x_ms-rterangepaste-start"></span><span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Roberto Ullfig - rullfig@uic.edu</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Systems Administrator</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Enterprise Applications & Services | Technology Solutions</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">University of Illinois - Chicago</span>
<div><span id="x_x_x_ms-rterangepaste-end"></span></div>
</div>
</div>
</div>
</div>
</div>
</div>
<div id="x_x_x_appendonsend"></div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_x_x_divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Cantor, Scott <cantor.2@osu.edu><br>
<b>Sent:</b> Tuesday, April 27, 2021 8:53 AM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: SP Requiring/Requesting MFA (was Re: Customizing Second Factor Configuration in mfa-authn-config.xml)</font>
<div> </div>
</div>
<div class="x_x_x_BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="x_x_x_PlainText">On 4/27/21, 9:20 AM, "users on behalf of Ullfig, Roberto Alfredo" <users-bounces@shibboleth.net on behalf of rullfig@uic.edu> wrote:<br>
<br>
> OK I thought that might be the case, but then that brings me back to my first question. If I have only MFA<br>
> enabled then every service provider goes through this MFA Transition Map, right?<br>
<br>
Barring SSO, yes.<br>
<br>
> If I want to enable Duo for just a few SPs I asked if I should put that code here but then you said I should be<br>
> using a relying party profile for each SP, but if MFA is the only one enabled how is that going to work?<br>
<br>
Firstly, I said overrides, not "overrides for each SP". I would never say that. There are many ways to control behavior, and doing it per-SP is thw worst. The best is the metadata-driven configuration feature. The second best is probably a custom metadata tag/EntityAttribute
and a by-tag override, and sometimes that's even the best. The worst is by a specific SP or list of SPs hardcoded into a file.<br>
<br>
To address the main point of confusion, MFA (the flow ID) does not mean multi-factor authentication, and it was a mistake to call it that. The MFA flow is an orchestration layer for login flows that simply replaces the original IdP login selection process with
a different layer that's scriptable and more capable. It should have been the original design to start with.<br>
<br>
It doesn't do MFA itself. Combining flows like Duo, or running flows that do multi-factor alone is what produces multi-factor authentication organically.<br>
<br>
The rules you provide are what determine how authentication is done.<br>
<br>
You are meant to control the system's behavior by associating custom Principal objects that in some cases represent AuthnContext classes with login flows and other configuration objects such as relying party overrides, metadata tags, etc. That is less brittle
and is dynamic without requiring restarts to change every detail.<br>
<br>
The orchestration, when done properly, automatically figures out what has to happen to satisfy a request by running the isAcceptable() methods scattered around the API, principally the one hanging off the MultiFactorAuthenticationContext object which is what
the examples I have provided show how to do. They simply decide whether to run flows based on whether the previous results are already sufficient to complete the request.<br>
<br>
When isAcceptable returns true, the results that have been produced are already sufficient to meet the requirements of a request, which by implication means there's no need to do anything else. When that's done, you get step-up automatically and the amount
of configuration is extremely minimal and never has to be touched.<br>
<br>
-- Scott<br>
<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=04%7C01%7C%7Cbb170a5c4ea94e1d910c08d9171699ff%7Cce6d05e13c5e4d6287a84c4a2713c113%7C0%7C0%7C637566208709090060%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=JmI7NvXoQSwV2X477U%2FhDax9Aovnug699PTTTM7B4EE%3D&reserved=0" originalsrc="https://wiki.shibboleth.net/confluence/x/coFAAg" shash="OWmS/D/ZJRlKznOLlHQAuR21aclwnVf3Nio5aISOeQG+rZ2bs4xbRXroECcB+qVp+ZJUmBhq85eSfLBuKzoyqCgJJ53G7qL7R3uMHjgaA17LVpF3L+tTcjn+tVrMSN9lCEvzgyVoMxTgNP95gUBE4+V9/JaKynNaWxSlQ16jwYA=">
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=04%7C01%7Crullfig%40uic.edu%7C88ba1b4203e64625074408d90983e5c8%7Ce202cd477a564baa99e3e3b71a7c77dd%7C0%7C0%7C637551284374420403%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=QY%2BpX7CGWRahbQcGswjKMknMJzEWIZNQS93pwRz%2Bf4o%3D&reserved=0</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font></div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>