<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Ah, I understand now. Don't do it by forcing the MFA authnContextClass. Use MFA logic to decide which users and SPs will use MFA. Here is our authn/mfa-authn-config.xml logic:</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
nextFlow = "authn/Duo";
<div><br>
</div>
<div> logger = Java.type("org.slf4j.LoggerFactory").getLogger("checkSecondFactor");</div>
<div> logger.debug('Starting checkSecondFactor');</div>
<div><br>
</div>
<div> // Setup some environment for later</div>
<div> resCtx = input.getSubcontext("net.shibboleth.idp.attribute.resolver.context.AttributeResolutionContext", true);</div>
<div> usernameLookupStrategyClass = Java.type("net.shibboleth.idp.session.context.navigate.CanonicalUsernameLookupStrategy");</div>
<div> usernameLookupStrategy = new usernameLookupStrategyClass();</div>
<div> username = usernameLookupStrategy.apply(input);</div>
<div> resCtx.setPrincipal(username);</div>
<div> stringType = Java.type("net.shibboleth.idp.attribute.StringAttributeValue");</div>
<div><br>
</div>
<div> authCtx = input.getSubcontext("net.shibboleth.idp.authn.context.AuthenticationContext");</div>
<div> mfaCtx = authCtx.getSubcontext("net.shibboleth.idp.authn.context.MultiFactorAuthenticationContext");</div>
<div><br>
</div>
<div> // Fetch Duo attributes</div>
<div> resCtx.getRequestedIdPAttributeNames().add("needs_duo");</div>
<div> resCtx.getRequestedIdPAttributeNames().add("has_duo");</div>
<div> resCtx.resolveAttributes(custom);</div>
<div> needs_duo = resCtx.getResolvedIdPAttributes().get("needs_duo");</div>
<div> has_duo = resCtx.getResolvedIdPAttributes().get("has_duo");</div>
<div><br>
</div>
<div> // If SP requires Duo or needs_duo == 1 (opted-in or mandatory)</div>
<div> if (! mfaCtx.isAcceptable() || (needs_duo != null && needs_duo.getValues().contains(new stringType("1")))) {</div>
<div> logger.debug('Duo is required');</div>
<div> if (has_duo == null || (has_duo != null && ! has_duo.getValues().contains(new stringType("1")))) {</div>
<div> logger.info("Duo is required but user cannot use Duo (username=" + username + ")");</div>
<div> mfaCtx.setEvent('DuoRequired');</div>
<div> nextFlow = null;</div>
<div> }</div>
<div> }</div>
<div> else {</div>
<div> nextFlow = null;</div>
<div> }</div>
<div><br>
</div>
<div> input.removeSubcontext(resCtx); // cleanup</div>
<div><br>
</div>
<span> nextFlow; // pass control to second factor or end with the first</span></div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
We have 2 attributes that we use: needs_duo and has_duo. needs_duo is another way, besides the authnContextClass override, that we force or exempt a user or SP from Duo. has_duo is a boolean indicating whether the user is enrolled in Duo. Here is the definition
of needs_duo from attribute-resolver.xml:</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<AttributeDefinition id="needs_duo" xsi:type="ScriptedAttribute">
<div> <InputDataConnector ref="ONIDLDAP" attributeNames="ismemberof" /></div>
<div> <Script><![CDATA[</div>
<div> logger = Java.type("org.slf4j.LoggerFactory").getLogger("net.shibboleth.idp.attribute.resolver.needs_duo</div>
<div>");</div>
<div> duoflag = "0";</div>
<div> duooptin = "0";</div>
<div> for (i=0; i < ismemberof.getValues().size(); i++) {</div>
<div> tmp = ismemberof.getValues().get(i);</div>
<div> if (tmp.toLowerCase().equals("cn=duo-opt-in,ou=duo,ou=app,ou=is,ou=org,ou=osu,ou=grouper,ou=groups,o=orst.edu")) {</div>
<div> logger.debug("User is opted-in to Duo");</div>
<div> duoflag = "1";</div>
<div> duooptin = "1";</div>
<div> }</div>
<div> if (tmp.toLowerCase().equals("cn=duo-mandatory,ou=duo,ou=app,ou=grouper,ou=groups,o=orst.edu")) {</div>
<div> logger.debug("User is mandatory Duo");</div>
<div> duoflag = "1";</div>
<div> }</div>
<div> }</div>
<div> rpid = profileContext.getSubcontext("net.shibboleth.idp.profile.context.RelyingPartyContext").getRelyingPartyId();</div>
<div> logger.debug("rpid=" + rpid);</div>
<div> // exclude the Duo sign up page for anyone not signed up</div>
<div> if (duooptin.equals("0") && rpid.match(/^https:\/\/secure\.onid\.oregonstate\.edu\/duo\/sign-up.*/)) {</div>
<div> logger.debug("skipping Duo for Duo sign up");</div>
<div> duoflag = "0";</div>
<div> }</div>
<div> // exclude the Duo phone reactivation page for anyone signed up</div>
<div> if (duooptin.equals("1") && rpid.match(/^https:\/\/secure\.onid\.oregonstate\.edu\/duo\/phone-reactivation.*/)) {</div>
<div> logger.debug("skipping Duo for Duo phone reactivation");</div>
<div> duoflag = "0";</div>
<div> }</div>
<div> // exclude a few SPs that are special</div>
<div> if (duooptin.equals("1")) {</div>
<div> if (rpid.equals("https://app.uhds.oregonstate.edu/resdesk/selfservice") ) {</div>
<div> logger.debug("skipping Duo for this entityID");</div>
<div> duoflag = "0";</div>
<div> }</div>
<span> }</span></div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
// require Duo for this entityID
<div> if (duoflag.equals("0")) {</div>
<div> if (rpid.equals("https://OSU.snowflakecomputing.com")) {</div>
<div> logger.debug("requiring Duo for this entityID");</div>
<div> duoflag = "1";</div>
<div> }</div>
<div> }</div>
<div> needs_duo.addValue(duoflag);</div>
<div> logger.debug("needs_duo final value: " + needs_duo.getValues().get(0));</div>
<div> ]]></Script></div>
<span> </AttributeDefinition></span></div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
It's a bit of a mess, but hopefully you get the general idea!</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Since we are not overriding the authnContextClass, we can require MFA without breaking services that specifically request PasswordProtectedTransport. We ran into this issue with snowflake, which you can see in the needs_duo code.</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
We only force MFA for a small number of SPs (mostly via overrides). Our "mandatory" Duo is enforced on users, not services, because we allow a grace period before they must use Duo.</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Andy<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div>
<div id="appendonsend"></div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Ullfig, Roberto Alfredo <rullfig@uic.edu><br>
<b>Sent:</b> Saturday, May 15, 2021 7:30 AM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: SP Requiring/Requesting MFA (was Re: Customizing Second Factor Configuration in mfa-authn-config.xml)</font>
<div> </div>
</div>
<div dir="ltr">
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;">
<span style="color:#D73F09">[This email originated from outside of OSU. Use caution with links and attachments.]</span></p>
<div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
We want to start rolling out MFA. The plan is to force MFA for some applications at first with essentially the same code as you have in your relying-party.xml but at some point the plan would be to make that the default policy in relying-party (we have over
240 active service providers in use, we only manage a handful of them) - however, when we do that we will likely be breaking some of those applications, the ones that are requesting authn themselves (because of p:disallowedFeatures-ref="SAML2.SSO.FEATURE_AUTHNCONTEXT"
setting). We could add some extra logging to the IDP ahead of time to see who is making these authn requests and prepare for that to some degree. Then we will need to decide what to with applications that are making authn requests - as some of them may be
requesting Password. We could make exceptions for them or we can decide to not support them - that's a policy decision to be determined.</div>
<div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div id="x_Signature">
<div>
<div></div>
<div id="x_divtagdefaultwrapper" style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
<div style="font-family:Tahoma; font-size:13px">---
<div><span id="x_ms-rterangepaste-start"></span><span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Roberto Ullfig - rullfig@uic.edu</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Systems Administrator</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Enterprise Applications & Services | Technology Solutions</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">University of Illinois - Chicago</span>
<div><span id="x_ms-rterangepaste-end"></span></div>
</div>
</div>
</div>
</div>
</div>
</div>
<div id="x_appendonsend"></div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Andrew Jason Morgan <morgan@oregonstate.edu><br>
<b>Sent:</b> Friday, May 14, 2021 4:30 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: SP Requiring/Requesting MFA (was Re: Customizing Second Factor Configuration in mfa-authn-config.xml)</font>
<div> </div>
</div>
<div dir="ltr">
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Roberto,</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
I may have missed the beginning of this thread, so I apologize if I'm asking you to repeat yourself.</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
What are you trying to accomplish? Do you have some specific SPs that need MFA? Are you just starting to rollout MFA to your users?</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
The context-check flow is an access control check, if you want to implement some access control at the IDP instead of the SP. We use it for services that can't perform their own access control. You can ignore that detail - it's not relevant for this discussion.</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Thanks,</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Andy<br>
</div>
<div>
<div id="x_x_appendonsend"></div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_x_divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Ullfig, Roberto Alfredo <rullfig@uic.edu><br>
<b>Sent:</b> Friday, May 14, 2021 2:13 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: SP Requiring/Requesting MFA (was Re: Customizing Second Factor Configuration in mfa-authn-config.xml)</font>
<div> </div>
</div>
<div dir="ltr">
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px">
<span style="color:#D73F09">[This email originated from outside of OSU. Use caution with links and attachments.]</span></p>
<div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span style="font-size:12pt; font-family:Calibri,Helvetica,sans-serif">OK, but since we don't manage many SPs, metadata-driven configuration doesn't seem very useful. Not one SP in InCommon is doing this that I can see. Is this something that InCommon is planning
on supporting in the near future? That Relying Party configuration we do have but we don't have
</span><span style="font-family:Calibri,Helvetica,sans-serif; background-color:rgb(255,255,255); display:inline!important; font-size:12pt">p:postAuthenticationFlows="#{{'context-check'}}"- what is that for? Scott mentioned metadata-driven configuration as the
best solution I believe, but exactly how would that be implemented? It has to be done by the Federation no?</span></div>
<div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div id="x_x_x_Signature">
<div>
<div></div>
<div id="x_x_x_divtagdefaultwrapper" style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
<div style="font-family:Tahoma; font-size:13px">---
<div><span id="x_x_x_ms-rterangepaste-start"></span><span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Roberto Ullfig - rullfig@uic.edu</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Systems Administrator</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Enterprise Applications & Services | Technology Solutions</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">University of Illinois - Chicago</span>
<div><span id="x_x_x_ms-rterangepaste-end"></span></div>
</div>
</div>
</div>
</div>
</div>
</div>
<div id="x_x_x_appendonsend"></div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_x_x_divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Andrew Jason Morgan <morgan@oregonstate.edu><br>
<b>Sent:</b> Friday, May 14, 2021 3:42 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: SP Requiring/Requesting MFA (was Re: Customizing Second Factor Configuration in mfa-authn-config.xml)</font>
<div> </div>
</div>
<div dir="ltr">
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Via metadata-driven configuration, by adding this to the metadata for the SP:</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<Extensions>
<div> <mdattr:EntityAttributes></div>
<div> <saml:Attribute Name="http://shibboleth.net/ns/profiles/defaultAuthenticationMethods"</div>
<div> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"></div>
<div> <saml:AttributeValue>https://refeds.org/profile/mfa</saml:AttributeValue></div>
<div> </saml:Attribute></div>
<div> <!-- The disallowedFeatures setting is a bitmask, and 0x1 blocks SPs requesting authentication types. --></div>
<div> <saml:Attribute Name="http://shibboleth.net/ns/profiles/disallowedFeatures"</div>
<div> NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"></div>
<div> <saml:AttributeValue>0x1</saml:AttributeValue></div>
<div> </saml:Attribute></div>
<div> </mdattr:EntityAttributes></div>
<span> </Extensions></span></div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
If you need to do it via relying-party.xml, just list only the MFA principal bean as allowed. Here is an example:</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<!-- MFA authenticationContextClass setup -->
<div> <bean id="MFASAML2Principal" parent="shibboleth.SAML2AuthnContextClassRef" c:classRef="https://refeds.org/profile/mfa" /></div>
<span></span></div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<!-- Require Duo -->
<div> <bean parent="RelyingPartyByName" c:relyingPartyIds="#{{'<entityID1>', '<entityID2>'}}"></div>
<div> <property name="profileConfigurations"></div>
<div> <list></div>
<div> <bean parent="SAML2.SSO" p:disallowedFeatures-ref="SAML2.SSO.FEATURE_AUTHNCONTEXT" p:postAuthenticationFlows="#{{'context-check'}}"></div>
<div> <property name="defaultAuthenticationMethods"></div>
<div> <list></div>
<div> <ref bean="MFASAML2Principal" /></div>
<div> </list></div>
<div> </property></div>
<div> </bean></div>
<div> </list></div>
<div> </property></div>
<span> </bean></span><br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div>
<div id="x_x_x_x_appendonsend"></div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Thanks,</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Andy<br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_x_x_x_divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Ullfig, Roberto Alfredo <rullfig@uic.edu><br>
<b>Sent:</b> Friday, May 14, 2021 1:26 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: SP Requiring/Requesting MFA (was Re: Customizing Second Factor Configuration in mfa-authn-config.xml)</font>
<div> </div>
</div>
<div dir="ltr">
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px">
<span style="color:#D73F09">[This email originated from outside of OSU. Use caution with links and attachments.]</span></p>
<div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Hello Andy, how exactly do you force MFA via metadata?</div>
<div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div id="x_x_x_x_x_Signature">
<div>
<div></div>
<div id="x_x_x_x_x_divtagdefaultwrapper" style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
<div style="font-family:Tahoma; font-size:13px">---
<div><span id="x_x_x_x_x_ms-rterangepaste-start"></span><span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Roberto Ullfig - rullfig@uic.edu</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Systems Administrator</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Enterprise Applications & Services | Technology Solutions</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">University of Illinois - Chicago</span>
<div><span id="x_x_x_x_x_ms-rterangepaste-end"></span></div>
</div>
</div>
</div>
</div>
</div>
</div>
<div id="x_x_x_x_x_appendonsend"></div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_x_x_x_x_divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Andrew Jason Morgan <morgan@oregonstate.edu><br>
<b>Sent:</b> Friday, May 14, 2021 3:16 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: SP Requiring/Requesting MFA (was Re: Customizing Second Factor Configuration in mfa-authn-config.xml)</font>
<div> </div>
</div>
<div dir="ltr">
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Roberto,</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Our IDP uses the following MFA logic:</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<ul>
<li><span>If the SP requests MFA or we force MFA via metadata, perform MFA (or return a SAML error if the user cannot MFA)</span></li><li><span>If the SP requests PasswordProtectedTransport or does not specify an authncontextclass:</span></li><ul>
<li><span>If the user is enrolled in Duo, perform MFA</span></li><li><span>If the user is not enrolled in Duo, no not perform MFA</span></li></ul>
</ul>
<div>Basically, we make our users MFA all the time if they are enrolled in Duo. We also force most of our users to enroll in Duo. Only early admits are excluded from mandatory enrollment.</div>
<div><br>
</div>
<div>Do you need help configuring your IDP as described above, assuming that is your goal?</div>
<div><br>
</div>
<div>Thanks,<br>
</div>
<div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div id="x_x_x_x_x_x_Signature">
<div>
<div></div>
<div></div>
<div></div>
<div><span style="font-family:Arial,Helvetica,sans-serif; font-size:12pt">Andy Morgan, Identity & Access Management, IT Operations and Identity</span></div>
<div><span style="font-family:Arial,Helvetica,sans-serif; font-size:12pt">Oregon State University | University Information and Technology | 541-737-8877</span><span style="font-family:Verdana,Geneva,sans-serif; font-size:11pt"><br>
</span></div>
</div>
</div>
</div>
</div>
<div>
<div id="x_x_x_x_x_x_appendonsend"></div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_x_x_x_x_x_divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Ullfig, Roberto Alfredo <rullfig@uic.edu><br>
<b>Sent:</b> Friday, May 14, 2021 1:05 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: SP Requiring/Requesting MFA (was Re: Customizing Second Factor Configuration in mfa-authn-config.xml)</font>
<div> </div>
</div>
<div dir="ltr">
<p style="margin-top: 0px; margin-bottom: 0px;margin-top: 0px; margin-bottom: 0px;margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px; margin-top:0px; margin-bottom:0px">
<span style="color:#D73F09">[This email originated from outside of OSU. Use caution with links and attachments.]</span></p>
<div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Is this an accurate summation of MFA/Password selection?</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<span style="margin:0px; font-size:12pt; color:black; background-color:rgb(255,255,255)"><span style="margin:0px">The attacker (that knows the password) can send a non-MFA Authn request (like Password) to the IDP and the IDP must accept it or reject it. If
accepted, the attacker is in without MFA (Scenario Three below), if rejected SSO just breaks (Scenario One below).</span></span>
<div style="margin:0px; font-size:12pt; color:black; background-color:rgb(255,255,255)">
<br>
</div>
<div style="margin:0px; font-size:12pt; color:black; background-color:rgb(255,255,255)">
scenarios:</div>
<div style="margin:0px; font-size:12pt; color:black; background-color:rgb(255,255,255)">
<br>
</div>
<div style="margin:0px; font-size:12pt; color:black; background-color:rgb(255,255,255)">
One:</div>
<div style="margin:0px; font-size:12pt; color:black; background-color:rgb(255,255,255)">
<ol>
<li><span style="margin:0px">SP sends authn request (MFA or Password) to IDP</span></li><li><span style="margin:0px">IDP rejects authn request</span></li><li>There is no SSO</li></ol>
<div style="margin:0px">Two:</div>
<ol start="4">
<li><span style="margin:0px"><span style="margin:0px; background-color:white">SP sends authn (MFA) request to IDP</span></span></li><li><span style="margin:0px"><span style="margin:0px">IDP accepts authn request</span><br>
</span></li><li>SSO with MFA</li></ol>
<div style="margin:0px">Three:</div>
<div style="margin:0px"></div>
<div style="margin:0px">
<ol>
<li><span style="margin:0px"><span style="margin:0px; background-color:white">SP sends authn (Password) request to IDP</span><br>
</span></li><li><span style="margin:0px"><span style="margin:0px; background-color:white"><span style="margin:0px"><span style="margin:0px">IDP accepts authn request</span></span><br>
</span></span></li><li><span style="margin:0px"><span style="margin:0px; background-color:white"><span style="margin:0px"><span style="margin:0px">SSO without MFA</span></span></span></span></li></ol>
<div style="margin:0px"><span style="margin:0px"><span style="margin:0px; background-color:white"><span style="margin:0px"><span style="margin:0px">Four</span></span></span></span></div>
</div>
<div style="margin:0px">
<ol>
<li><span style="margin:0px"><span style="margin:0px; background-color:white"><span style="margin:0px"><span style="margin:0px">SP does NOT send authn request to IDP</span></span></span></span></li><li><span style="margin:0px"><span style="margin:0px; background-color:white"><span style="margin:0px"><span style="margin:0px">IDP does whatever it wants (Password or MFA) - this is when we can force it to MFA</span></span></span></span></li></ol>
<div style="margin:0px"><span style="margin:0px"><span style="margin:0px; background-color:white"><span style="margin:0px"><span style="margin:0px"><br>
</span></span></span></span></div>
</div>
<div style="margin:0px"><span style="margin:0px"><span style="margin:0px; background-color:white"><span style="margin:0px"><span style="margin:0px">ITrust Federation Manager for some reason is sending BOTH MFA and Password authn requests so what's used by the
IDP is undefined but it looks like our IDP is just using the last one sent which is Password because that's what's being used.</span></span></span></span></div>
<div style="margin:0px"><span style="margin:0px"><span style="margin:0px; background-color:white"><span style="margin:0px"><span style="margin:0px"><br>
</span></span></span></span></div>
<span style="margin:0px"><span style="margin:0px"><span style="margin:0px; background-color:white"><span style="margin:0px"><span style="margin:0px">The authn request always has priority over anything that we have configured for that SP. If we accept the authn
request the IDP must do what the SP requests. If we reject it, there is no SSO.</span></span></span></span></span></div>
<div style="margin:0px; font-size:12pt; color:black; background-color:rgb(255,255,255)">
<span style="margin:0px"><span style="margin:0px"><span style="margin:0px; background-color:white"><span style="margin:0px"><span style="margin:0px"><br>
</span></span></span></span></span></div>
<div style="margin:0px; font-size:12pt; color:black; background-color:rgb(255,255,255)">
<span style="margin:0px"><span style="margin:0px"><span style="margin:0px; background-color:white"><span style="margin:0px"><span style="margin:0px">Finally, Scenario Four is not the best solution, the better solution is to control MFA via metadata.</span></span></span></span></span></div>
<br>
</div>
<div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div id="x_x_x_x_x_x_x_Signature">
<div>
<div></div>
<div id="x_x_x_x_x_x_x_divtagdefaultwrapper" style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
<div style="font-family:Tahoma; font-size:13px">---
<div><span id="x_x_x_x_x_x_x_ms-rterangepaste-start"></span><span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Roberto Ullfig - rullfig@uic.edu</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Systems Administrator</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Enterprise Applications & Services | Technology Solutions</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">University of Illinois - Chicago</span>
<div><span id="x_x_x_x_x_x_x_ms-rterangepaste-end"></span></div>
</div>
</div>
</div>
</div>
</div>
</div>
<div id="x_x_x_x_x_x_x_appendonsend"></div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_x_x_x_x_x_x_divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Cantor, Scott <cantor.2@osu.edu><br>
<b>Sent:</b> Tuesday, April 27, 2021 8:53 AM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: SP Requiring/Requesting MFA (was Re: Customizing Second Factor Configuration in mfa-authn-config.xml)</font>
<div> </div>
</div>
<div class="x_x_x_x_x_x_x_BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="x_x_x_x_x_x_x_PlainText">On 4/27/21, 9:20 AM, "users on behalf of Ullfig, Roberto Alfredo" <users-bounces@shibboleth.net on behalf of rullfig@uic.edu> wrote:<br>
<br>
> OK I thought that might be the case, but then that brings me back to my first question. If I have only MFA<br>
> enabled then every service provider goes through this MFA Transition Map, right?<br>
<br>
Barring SSO, yes.<br>
<br>
> If I want to enable Duo for just a few SPs I asked if I should put that code here but then you said I should be<br>
> using a relying party profile for each SP, but if MFA is the only one enabled how is that going to work?<br>
<br>
Firstly, I said overrides, not "overrides for each SP". I would never say that. There are many ways to control behavior, and doing it per-SP is thw worst. The best is the metadata-driven configuration feature. The second best is probably a custom metadata tag/EntityAttribute
and a by-tag override, and sometimes that's even the best. The worst is by a specific SP or list of SPs hardcoded into a file.<br>
<br>
To address the main point of confusion, MFA (the flow ID) does not mean multi-factor authentication, and it was a mistake to call it that. The MFA flow is an orchestration layer for login flows that simply replaces the original IdP login selection process with
a different layer that's scriptable and more capable. It should have been the original design to start with.<br>
<br>
It doesn't do MFA itself. Combining flows like Duo, or running flows that do multi-factor alone is what produces multi-factor authentication organically.<br>
<br>
The rules you provide are what determine how authentication is done.<br>
<br>
You are meant to control the system's behavior by associating custom Principal objects that in some cases represent AuthnContext classes with login flows and other configuration objects such as relying party overrides, metadata tags, etc. That is less brittle
and is dynamic without requiring restarts to change every detail.<br>
<br>
The orchestration, when done properly, automatically figures out what has to happen to satisfy a request by running the isAcceptable() methods scattered around the API, principally the one hanging off the MultiFactorAuthenticationContext object which is what
the examples I have provided show how to do. They simply decide whether to run flows based on whether the previous results are already sufficient to complete the request.<br>
<br>
When isAcceptable returns true, the results that have been produced are already sufficient to meet the requirements of a request, which by implication means there's no need to do anything else. When that's done, you get step-up automatically and the amount
of configuration is extremely minimal and never has to be touched.<br>
<br>
-- Scott<br>
<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=04%7C01%7C%7Cfa435929b6f946e5c93d08d917ae00c0%7Cce6d05e13c5e4d6287a84c4a2713c113%7C0%7C0%7C637566859119300262%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=3nH5bUXf%2FpoI%2B4sData6RoLbHlJNoRE0JCb3rsNxYIk%3D&reserved=0" originalsrc="https://wiki.shibboleth.net/confluence/x/coFAAg" shash="vGpK+4vlzLlnPjKJAcU3kBfm+7g4Wc3jFB0gje6ogSNlJH9+0roceOXVg2zoDxJPBGATvsbz+7YPLsRsIe0HCkV5DfbflXxVkUA5iFRWzQZsoXeGdG1u1+lRuoPTtD84aqmH9jhR11wlLxCl9hDUzG6CSclHYp2AoLLkNbMetRk=">
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fwiki.shibboleth.net%2Fconfluence%2Fx%2FcoFAAg&data=04%7C01%7Crullfig%40uic.edu%7C88ba1b4203e64625074408d90983e5c8%7Ce202cd477a564baa99e3e3b71a7c77dd%7C0%7C0%7C637551284374420403%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=QY%2BpX7CGWRahbQcGswjKMknMJzEWIZNQS93pwRz%2Bf4o%3D&reserved=0</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font></div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>