<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.MsoPlainText, li.MsoPlainText, div.MsoPlainText
{mso-style-priority:99;
mso-style-link:"Plain Text Char";
margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.PlainTextChar
{mso-style-name:"Plain Text Char";
mso-style-priority:99;
mso-style-link:"Plain Text";
font-family:"Calibri",sans-serif;}
span.EmailStyle21
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.EmailStyle22
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:#1F497D;}
span.EmailStyle23
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="#0563C1" vlink="#954F72">
<div class="WordSection1">
<p class="MsoNormal">Dear Shibboleth Users,<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Current at Rockefeller we are using Shibboleth IDP version 3.4. I am trying to enable MFA (Duo as second factor) for NIH requirements.
<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">As a reference document I followed: <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__shibboleth.atlassian.net_wiki_spaces_KB_pages_1474297850_Supporting-2Bthe-2BREFEDS-2BMFA-2BProfile&d=DwMFAg&c=JeTkUgVztGMmhKYjxsy2rfoWYibK1YmxXez1G3oNStg&r=-CYQGhDCW_XVXWqNKPn5s07p1awyFSt0c0S-5qutrqc&m=Gyt05Sr06PPRAba170ENJxDDiU6dVkfJ-09G4f1pla0&s=k_3iPif_91EwUiGtE8W2LuBXxonmmhjx-nWUfVAA9kw&e=">
Supporting the REFEDS MFA Profile - Shibboleth Knowledge Base - Shibboleth Wiki (atlassian.net)</a>, I am unable to get the Duo working, running into following error:<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoPlainText">2021-07-12 13:07:03,552 - DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:?] - Profile Action TransitionMultiFactorAuthentication: Applying MFA transition rule to exit state 'authn/Password'<o:p></o:p></p>
<p class="MsoPlainText">2021-07-12 13:07:03,568 - DEBUG [net.shibboleth.idp.authn.principal.<span style="color:red">PrincipalEvalPredicateFactoryRegistry</span>:?] - Registry located predicate factory of type 'net.shibboleth.idp.authn.principal.impl.ExactPrincipalEvalPredicateFactory'
for principal type 'class net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal' and operator 'exact'<o:p></o:p></p>
<p class="MsoPlainText">2021-07-12 13:07:03,568 - DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:?] - Profile Action TransitionMultiFactorAuthentication: MFA flow transition after 'proceed' event to 'authn/Duo' flow<o:p></o:p></p>
<p class="MsoPlainText">2021-07-12 13:07:03,568 - <span style="color:red;background:silver;mso-highlight:silver">
ERROR [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:290] - Profile Action TransitionMultiFactorAuthentication: Targeted login flow 'authn/Duo' does not support forced re-authentication</span><span style="color:red"><o:p></o:p></span></p>
<p class="MsoPlainText">2021-07-12 13:07:03,572 - WARN [org.opensaml.profile.action.impl.LogEvent:105] -
<span style="color:#0070C0">A non-proceed event occurred while processing the request: RequestUnsupported<o:p></o:p></span></p>
<p class="MsoPlainText">2021-07-12 13:07:03,583 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:?] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.messaging.handler.impl.BasicMessageHandlerChain'
on OUTBOUND message context<o:p></o:p></p>
<p class="MsoPlainText">2021-07-12 13:07:03,583 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:?] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.ResponseImpl'<o:p></o:p></p>
<p class="MsoPlainText">2021-07-12 13:07:03,583 - DEBUG [net.shibboleth.idp.saml.profile.impl.SpringAwareMessageEncoderFactory:?] - Looking up message encoder based on binding URI: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST<o:p></o:p></p>
<p class="MsoPlainText">2021-07-12 13:07:03,586 - DEBUG [PROTOCOL_MESSAGE:?] -<o:p></o:p></p>
<p class="MsoPlainText"><?xml version="1.0" encoding="UTF-8"?><saml2p:Response xmlns:saml2p="urn:oasis:names:tc:SAML:2.0:protocol" Destination="<a href="https://federation.nih.gov/Shibboleth.sso/SAML2/POST">https://federation.nih.gov/Shibboleth.sso/SAML2/POST</a>"
ID="_2374d70a65b269080befa94986619158" InResponseTo="_d7170118348da48a64c60f198474f750" IssueInstant="2021-07-12T17:07:03.579Z" Version="2.0"><o:p></o:p></p>
<p class="MsoPlainText"> <saml2:Issuer xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"><a href="https://rushib.rockefeller.edu/idp/shibboleth%3c/saml2:Issuer">https://rushib.rockefeller.edu/idp/shibboleth</saml2:Issuer</a>><o:p></o:p></p>
<p class="MsoPlainText"> <saml2p:Status><o:p></o:p></p>
<p class="MsoPlainText"> <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Requester"><o:p></o:p></p>
<p class="MsoPlainText"> <saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:NoAuthnContext"/><o:p></o:p></p>
<p class="MsoPlainText"> </saml2p:StatusCode><o:p></o:p></p>
<p class="MsoPlainText"> <saml2p:StatusMessage>An error occurred.</saml2p:StatusMessage><o:p></o:p></p>
<p class="MsoPlainText"> </saml2p:Status><o:p></o:p></p>
<p class="MsoPlainText"></saml2p:Response><o:p></o:p></p>
<p class="MsoPlainText"><o:p> </o:p></p>
<p class="MsoPlainText">2021-07-12 13:07:03,586 - DEBUG [net.shibboleth.idp.profile.impl.RecordResponseComplete:?] - Profile Action RecordResponseComplete: Record response complete<o:p></o:p></p>
<p class="MsoPlainText">2021-07-12 13:07:03,586 - INFO [Shibboleth-Audit.SSO:?] - 20210712T170703Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_d7170118348da48a64c60f198474f750|https://federation.nih.gov/FederationGateway|http://shibboleth.net/ns/profiles/saml2/sso/browser|https://rushib.rockefeller.edu/idp/shibboleth|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_2374d70a65b269080befa94986619158||||||<o:p></o:p></p>
<p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto">My
<b><span style="font-size:12.0pt;font-family:"Times New Roman",serif">conf/authn/mfa-authn-config.xml</span></b><span style="font-size:12.0pt;font-family:"Times New Roman",serif"><o:p></o:p></span></p>
<p class="MsoNormalCxSpMiddle" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-add-space:auto">
<span style="font-size:12.0pt;font-family:"Times New Roman",serif"><util:map id="shibboleth.authn.MFA.TransitionMap"><br>
<entry key=""><br>
<bean parent="shibboleth.authn.MFA.Transition" p:nextFlow="authn/Password" /><br>
</entry><o:p></o:p></span></p>
<p class="MsoNormalCxSpMiddle" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-add-space:auto">
<span style="font-size:12.0pt;font-family:"Times New Roman",serif"><entry key="authn/Password"><br>
<bean parent="shibboleth.authn.MFA.Transition" p:nextFlowStrategy-ref="checkSecondFactor" /><br>
</entry><o:p></o:p></span></p>
<p class="MsoNormalCxSpMiddle" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-add-space:auto">
<span style="font-size:12.0pt;font-family:"Times New Roman",serif"></util:map><o:p></o:p></span></p>
<p class="MsoNormalCxSpMiddle" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-add-space:auto">
<span style="font-size:12.0pt;font-family:"Times New Roman",serif"><bean id="checkSecondFactor" parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript"><br>
<constructor-arg><br>
<value><br>
<![CDATA[<br>
nextFlow = "authn/Duo";<o:p></o:p></span></p>
<p class="MsoNormalCxSpMiddle" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-add-space:auto">
<span style="font-size:12.0pt;font-family:"Times New Roman",serif">authCtx = input.getSubcontext("net.shibboleth.idp.authn.context.AuthenticationContext");<br>
mfaCtx = authCtx.getSubcontext("net.shibboleth.idp.authn.context.MultiFactorAuthenticationContext");<br>
if (mfaCtx.isAcceptable()) <o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:12.0pt;font-family:"Times New Roman",serif">{ nextFlow = null; }
<o:p></o:p></span></p>
<p class="MsoNormalCxSpMiddle" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-add-space:auto">
<span style="font-size:12.0pt;font-family:"Times New Roman",serif">nextFlow; // pass control to second factor or end with the first<br>
]]><br>
</value><br>
</constructor-arg><br>
</bean><o:p></o:p></span></p>
<p class="MsoNormalCxSpMiddle" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto;mso-add-space:auto">
<span style="font-size:12.0pt;font-family:"Times New Roman",serif"><o:p> </o:p></span></p>
<p class="MsoNormal">Can someone help me what’s causing the issue?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Any help is really appreciated.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Thank you,<o:p></o:p></p>
<p class="MsoNormal">Srinivas.<o:p></o:p></p>
</div>
</body>
</html>