<div dir="ltr"><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small">So that user exception code should be as follows:</div><div class="gmail_default" style="font-size:small"><font face="monospace">// Entitlement group excepted from Duo<br>if( epe != null && epe.getValues().contains(new stringType("<a href="https://shibboleth.uic.edu/entitlement/shibexemptfromduo">https://shibboleth.uic.edu/entitlement/shibexemptfromduo</a>")) )<br>{<br> nextFlow = null;<br>}</font><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small"><br></div><div class="gmail_default" style="font-size:small"><span style="font-family:arial,helvetica,sans-serif">By having </span><font face="monospace">if( mfaCtx.isAcceptable() )</font><font face="arial, helvetica, sans-serif"> in there, you are still deferring to what the SP wants rather than overriding it.</font></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small"><br></div><div class="gmail_default" style="font-family:arial,helvetica,sans-serif;font-size:small">Cheers!</div><div><div dir="ltr" class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr"><div dir="ltr"><font face="arial, helvetica, sans-serif"><br>Brian Moon<br><font size="1">Senior System Administrator, Enterprise Systems</font></font></div><div dir="ltr"><font size="1"><font face="arial, helvetica, sans-serif">Santa Clara University</font></font></div></div></div></div><br></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Fri, Aug 13, 2021 at 10:35 AM Ullfig, Roberto Alfredo <<a href="mailto:rullfig@uic.edu">rullfig@uic.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div dir="ltr">
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
...but then that breaks my code to have user exceptions in mfa-authn-config.xml. Is there a way to force it by application in relying-party yet still have a user exception?</div>
<div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div id="gmail-m_-7510134759823413342Signature">
<div>
<div></div>
<div id="gmail-m_-7510134759823413342divtagdefaultwrapper" style="font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255);font-family:Calibri,Arial,Helvetica,sans-serif">
<div style="font-family:Tahoma;font-size:13px">---
<div><span id="gmail-m_-7510134759823413342ms-rterangepaste-start"></span><span style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">Roberto Ullfig - <a href="mailto:rullfig@uic.edu" target="_blank">rullfig@uic.edu</a></span><br style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">Systems Administrator</span><br style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">Enterprise Applications & Services | Technology Solutions</span><br style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">University of Illinois - Chicago</span>
<div><span id="gmail-m_-7510134759823413342ms-rterangepaste-end"></span></div>
</div>
</div>
</div>
</div>
</div>
</div>
<div id="gmail-m_-7510134759823413342appendonsend"></div>
<hr style="display:inline-block;width:98%">
<div id="gmail-m_-7510134759823413342divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Ullfig, Roberto Alfredo <<a href="mailto:rullfig@uic.edu" target="_blank">rullfig@uic.edu</a>><br>
<b>Sent:</b> Friday, August 13, 2021 12:28 PM<br>
<b>To:</b> Shib Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Subject:</b> Re: Forcing MFA for some SPs and not Others</font>
<div> </div>
</div>
<div dir="ltr">
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
That was it, was too quick to remove the code I had in relying-party.</div>
<div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div id="gmail-m_-7510134759823413342x_Signature">
<div>
<div></div>
<div id="gmail-m_-7510134759823413342x_divtagdefaultwrapper" style="font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255);font-family:Calibri,Arial,Helvetica,sans-serif">
<div style="font-family:Tahoma;font-size:13px">---
<div><span id="gmail-m_-7510134759823413342x_ms-rterangepaste-start"></span><span style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">Roberto Ullfig - <a href="mailto:rullfig@uic.edu" target="_blank">rullfig@uic.edu</a></span><br style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">Systems Administrator</span><br style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">Enterprise Applications & Services | Technology Solutions</span><br style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">University of Illinois - Chicago</span>
<div><span id="gmail-m_-7510134759823413342x_ms-rterangepaste-end"></span></div>
</div>
</div>
</div>
</div>
</div>
</div>
<div id="gmail-m_-7510134759823413342x_appendonsend"></div>
<hr style="display:inline-block;width:98%">
<div id="gmail-m_-7510134759823413342x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> users <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a>> on behalf of Ullfig, Roberto Alfredo <<a href="mailto:rullfig@uic.edu" target="_blank">rullfig@uic.edu</a>><br>
<b>Sent:</b> Friday, August 13, 2021 12:15 PM<br>
<b>To:</b> Shib Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Subject:</b> Re: Forcing MFA for some SPs and not Others</font>
<div> </div>
</div>
<div dir="ltr">
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
I had been using relying-party before but wanted more control so moved everything entirely to mfa-authn-config.xml. I can try with some of the old relying party code again, thanks.</div>
<div>
<div style="font-family:Calibri,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div id="gmail-m_-7510134759823413342x_x_Signature">
<div>
<div></div>
<div id="gmail-m_-7510134759823413342x_x_divtagdefaultwrapper" style="font-size:12pt;color:rgb(0,0,0);background-color:rgb(255,255,255);font-family:Calibri,Arial,Helvetica,sans-serif">
<div style="font-family:Tahoma;font-size:13px">---
<div><span id="gmail-m_-7510134759823413342x_x_ms-rterangepaste-start"></span><span style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">Roberto Ullfig - <a href="mailto:rullfig@uic.edu" target="_blank">rullfig@uic.edu</a></span><br style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">Systems Administrator</span><br style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">Enterprise Applications & Services | Technology Solutions</span><br style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif;font-size:13px;line-height:16.003px">University of Illinois - Chicago</span>
<div><span id="gmail-m_-7510134759823413342x_x_ms-rterangepaste-end"></span></div>
</div>
</div>
</div>
</div>
</div>
</div>
<div id="gmail-m_-7510134759823413342x_x_appendonsend"></div>
<hr style="display:inline-block;width:98%">
<div id="gmail-m_-7510134759823413342x_x_divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" color="#000000" style="font-size:11pt"><b>From:</b> users <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a>> on behalf of Brian Moon via users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Sent:</b> Friday, August 13, 2021 12:11 PM<br>
<b>To:</b> Shib Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Cc:</b> Brian Moon <<a href="mailto:bmoon@scu.edu" target="_blank">bmoon@scu.edu</a>><br>
<b>Subject:</b> Re: Forcing MFA for some SPs and not Others</font>
<div> </div>
</div>
<div>
<div dir="ltr">
<div style="font-family:arial,helvetica,sans-serif;font-size:small">
<div>Hello Roberto,</div>
<div><br>
</div>
<div>Check out this bit of documentation here: <a href="https://urldefense.com/v3/__https://nam04.safelinks.protection.outlook.com/?url=https*3A*2F*2Fshibboleth.atlassian.net*2Fwiki*2Fspaces*2FKB*2Fpages*2F1474297850*2FSupporting*2Bthe*2BREFEDS*2BMFA*2BProfile&data=04*7C01*7Crullfig*40uic.edu*7C258bf517821b4285086108d95e7df309*7Ce202cd477a564baa99e3e3b71a7c77dd*7C0*7C0*7C637644717300972742*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000&sdata=kzRqsYVnFdjgtwE*2ByLkXfdxSae77TaUeHPJXf9GQq6c*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUl!!MLMg-p0Z!U8iVwiYgYuzIXyJ-bCxnu9wCEbVsa5F5PFNbLHjXA6zbu58K5u8_ZQKaAAn8$" target="_blank">
https://shibboleth.atlassian.net/wiki/spaces/KB/pages/1474297850/Supporting+the+REFEDS+MFA+Profile</a></div>
<div><br>
</div>
<div>Basically what you need to do is ensure that you are directing everything to the MFA flow. Within the MFA flow, follow the example to check to see if a second factor is needed and then pass on control as needed.</div>
<div><br>
</div>
<div>You will also need to ensure that you have the MFA principals defined and then use conf/relying-party.xml to require MFA for certain SPs.</div>
</div>
<div style="font-family:arial,helvetica,sans-serif;font-size:small">
<br>
</div>
<div style="font-family:arial,helvetica,sans-serif;font-size:small">
Hope that helps</div>
<div>
<div dir="ltr">
<div dir="ltr">
<div dir="ltr"><font face="arial, helvetica, sans-serif"><br>
Brian Moon<br>
<font size="1">Senior System Administrator, Enterprise Systems</font></font></div>
<div dir="ltr"><font size="1"><font face="arial, helvetica, sans-serif">Santa Clara University</font></font></div>
</div>
</div>
</div>
<br>
</div>
<br>
<div>
<div dir="ltr">On Fri, Aug 13, 2021 at 10:02 AM Wessel, Keith <<a href="mailto:kwessel@illinois.edu" target="_blank">kwessel@illinois.edu</a>> wrote:<br>
</div>
<blockquote style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div lang="EN-US">
<div>
<p>That’s not true if you hve MFA configured properly. The second MFA should see that the currently satisfied authentication methods isn’t sufficient and should prompt the user for step-up authentication. That is, it’ll skip asking the
user for their username and password again but will go straight to the MFA prompt.<u></u><u></u></p>
<p><u></u> <u></u></p>
<p>Keith<u></u><u></u></p>
<p><u></u> <u></u></p>
<p><u></u> <u></u></p>
<div>
<div style="border-right:none;border-bottom:none;border-left:none;border-top:1pt solid rgb(225,225,225);padding:3pt 0in 0in">
<p><b>From:</b> users <<a href="mailto:users-bounces@shibboleth.net" target="_blank">users-bounces@shibboleth.net</a>>
<b>On Behalf Of </b>Ullfig, Roberto Alfredo<br>
<b>Sent:</b> Friday, August 13, 2021 11:56 AM<br>
<b>To:</b> Shib Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Subject:</b> Forcing MFA for some SPs and not Others<u></u><u></u></p>
</div>
</div>
<p><u></u> <u></u></p>
<div>
<p><span style="font-size:12pt;color:black">Is there a way for Shibboleth to create different cookies for different SPs? For instance, if I force MFA on an application on the IDP side I can easily get around MFA by logging into another
SP that doesn't require MFA first because I've already identified myself.<u></u><u></u></span></p>
</div>
<div>
<div>
<p><span style="font-size:12pt;color:black"><u></u> <u></u></span></p>
</div>
<div id="gmail-m_-7510134759823413342x_x_x_gmail-m_-1375537791944571034Signature">
<div>
<div id="gmail-m_-7510134759823413342x_x_x_gmail-m_-1375537791944571034divtagdefaultwrapper">
<div>
<p style="background:white"><span style="font-size:10pt;font-family:Tahoma,sans-serif;color:black">---
<u></u><u></u></span></p>
<div>
<p style="background:white"><span style="font-size:10pt;font-family:Arial,sans-serif;color:black">Roberto Ullfig -
<a href="mailto:rullfig@uic.edu" target="_blank">rullfig@uic.edu</a><br>
Systems Administrator<br>
Enterprise Applications & Services | Technology Solutions<br>
University of Illinois - Chicago</span><span style="font-size:10pt;font-family:Tahoma,sans-serif;color:black">
<u></u><u></u></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
-- <br>
For Consortium Member technical support, see <a href="https://urldefense.com/v3/__https://nam04.safelinks.protection.outlook.com/?url=https*3A*2F*2Furldefense.com*2Fv3*2F__https*3A*2F*2Fshibboleth.atlassian.net*2Fwiki*2Fx*2FZYEpPw__*3B!!MLMg-p0Z!WKibHMkiKehbRt_aA4QztTnM5sRY5yu43iAKRJPn2yGtdRNId64dO-3wEJMV*24&data=04*7C01*7Crullfig*40uic.edu*7C258bf517821b4285086108d95e7df309*7Ce202cd477a564baa99e3e3b71a7c77dd*7C0*7C0*7C637644717300972742*7CUnknown*7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0*3D*7C3000&sdata=LiLk0q5NstfLI39*2FAydfbI1p0C4kNnn3Sde3bweLJds*3D&reserved=0__;JSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUlJSUl!!MLMg-p0Z!U8iVwiYgYuzIXyJ-bCxnu9wCEbVsa5F5PFNbLHjXA6zbu58K5u8_ZWFLifAW$" rel="noreferrer" target="_blank">
https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!MLMg-p0Z!WKibHMkiKehbRt_aA4QztTnM5sRY5yu43iAKRJPn2yGtdRNId64dO-3wEJMV$</a>
<br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a><br>
</blockquote>
</div>
</div>
</div>
</div>
</div>
-- <br>
For Consortium Member technical support, see <a href="https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!MLMg-p0Z!U8iVwiYgYuzIXyJ-bCxnu9wCEbVsa5F5PFNbLHjXA6zbu58K5u8_ZWi4nnHM$" rel="noreferrer" target="_blank">https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!MLMg-p0Z!U8iVwiYgYuzIXyJ-bCxnu9wCEbVsa5F5PFNbLHjXA6zbu58K5u8_ZWi4nnHM$</a> <br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>