<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class="">Lucky you, this has beed documented: <a href="https://shibboleth.atlassian.net/wiki/spaces/KB/pages/1474297850/Supporting+the+REFEDS+MFA+Profile" class="">https://shibboleth.atlassian.net/wiki/spaces/KB/pages/1474297850/Supporting+the+REFEDS+MFA+Profile</a><br class=""><div class="">
<div><br class="">//<br class="">John Pfeifer<br class="">Division of Information Technology<br class="">University of Maryland, College Park</div>
</div>
<div><br class=""><blockquote type="cite" class=""><div class="">On Jul 28, 2021, at 2:51 PM, Murphy, Patrick <<a href="mailto:murphyp1@msu.edu" class="">murphyp1@msu.edu</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><meta charset="UTF-8" class=""><div class="WordSection1" style="page: WordSection1; caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;"><div style="margin: 0in; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">We are installing a new Shibboleth 4.1.2 IdP. We have it working with some of our existing sites that were migrated from V2. I need to figure out how to setup the MFA component to convert the MFA attributes supplied by our Okta SSO solution into the required ones for REFEDS/NIH. I am new to Shibboleth and the whole Spring beans configuration mechanism, so any pointers would be appreciated.<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class="">Here are the attribute values returned from Okta:<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 10.5pt; font-family: "Segoe UI", sans-serif;" class=""><saml2:AuthnStatement AuthnInstant="2021-07-27T18:56:30.122Z"<br class="">SessionIndex="_685bb706e2a3ecaa1d6ce10af4f826ef"<br class="">xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"><br class=""> <saml2:AuthnContext><br class=""> <saml2:AuthnContextClassRef>urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport</saml2:AuthnContextClassRef><br class=""> </saml2:AuthnContext><br class=""></saml2:AuthnStatement><o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 10.5pt; font-family: "Segoe UI", sans-serif;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 10.5pt; font-family: "Segoe UI", sans-serif;" class=""><saml2:AttributeStatement xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"><br class=""><saml2:Attribute Name="authenticationContext"<br class="">NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:unspecified"<br class="">><br class=""><saml2:AttributeValue xmlns:xs="<a href="http://www.w3.org/2001/XMLSchema" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">http://www.w3.org/2001/XMLSchema</a>"<br class="">xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">http://www.w3.org/2001/XMLSchema-instance</a>"<br class="">xsi:type="xs:string"<br class="">>swk</saml2:AttributeValue><br class=""><saml2:AttributeValue xmlns:xs="<a href="http://www.w3.org/2001/XMLSchema" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">http://www.w3.org/2001/XMLSchema</a>"<br class="">xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">http://www.w3.org/2001/XMLSchema-instance</a>"<br class="">xsi:type="xs:string"<br class="">>mfa</saml2:AttributeValue><br class=""><saml2:AttributeValue xmlns:xs="<a href="http://www.w3.org/2001/XMLSchema" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">http://www.w3.org/2001/XMLSchema</a>"<br class="">xmlns:xsi="<a href="http://www.w3.org/2001/XMLSchema-instance" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">http://www.w3.org/2001/XMLSchema-instance</a>"<br class="">xsi:type="xs:string"<br class="">>pwd</saml2:AttributeValue><br class=""></saml2:Attribute><br class=""></saml2:AttributeStatement><o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 10.5pt; font-family: "Segoe UI", sans-serif;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 10.5pt; font-family: "Segoe UI", sans-serif;" class="">I need to convert the attribute value to:<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 10.5pt; font-family: "Segoe UI", sans-serif;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 10.5pt; font-family: "Segoe UI", sans-serif;" class=""><saml2:AuthnStatement AuthnInstant="2021-07-27T18:56:30.122Z"<br class="">SessionIndex="_685bb706e2a3ecaa1d6ce10af4f826ef"<br class="">xmlns:saml2="urn:oasis:names:tc:SAML:2.0:assertion"><br class=""> <saml2:AuthnContext><br class=""> <saml2:AuthnContextClassRef><a href="https://refeds.org/profile/mfa%3c/saml2:AuthnContextClassRef%3e" target="_blank" title="https://refeds.org/profile/mfa</saml2:authncontextclassref>" style="color: rgb(5, 99, 193); text-decoration: underline;" class="">https://refeds.org/profile/mfa</saml2:AuthnContextClassRef></a><br class=""> </saml2:AuthnContext><br class=""></saml2:AuthnStatement><o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 10.5pt; font-family: "Segoe UI", sans-serif;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 10.5pt; font-family: "Segoe UI", sans-serif;" class=""><o:p class=""> </o:p></span></div><div style="margin: 0in; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 10.5pt; font-family: "Segoe UI", sans-serif;" class="">Thanks for any help you can provide.<o:p class=""></o:p></span></div><div style="margin: 0in; font-size: 12pt; font-family: Calibri, sans-serif;" class=""><span style="font-size: 11pt;" class=""><o:p class=""> </o:p></span></div></div><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">--<span class="Apple-converted-space"> </span></span><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">For Consortium Member technical support, see<span class="Apple-converted-space"> </span></span><a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" style="color: rgb(5, 99, 193); text-decoration: underline; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none;" class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">To unsubscribe from this list send an email to<span class="Apple-converted-space"> </span></span><a href="mailto:users-unsubscribe@shibboleth.net" style="color: rgb(5, 99, 193); text-decoration: underline; font-family: Helvetica; font-size: 12px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">users-unsubscribe@shibboleth.net</a></div></blockquote></div><br class=""></body></html>