<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hmm, I have this - every other test works fine:</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<util:map id="shibboleth.authn.MFA.TransitionMap">
<div> <entry key=""></div>
<div> <bean parent="shibboleth.authn.MFA.Transition" p:nextFlow="authn/RemoteUser" /></div>
<div> </entry></div>
<div> <entry key="authn/RemoteUser"></div>
<div> <bean parent="shibboleth.authn.MFA.Transition" p:nextFlowStrategy-ref="checkSecondFactor" /></div>
<div> </entry></div>
<div> <!-- An implicit final rule will return whatever the final flow returns. --></div>
<div> </util:map></div>
<div><br>
</div>
<div> <bean id="checkSecondFactor" parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript"</div>
<div> p:customObject-ref="shibboleth.AttributeResolverService"></div>
<div> <constructor-arg></div>
<div> <value></div>
<div> <![CDATA[</div>
<div><br>
</div>
<div> // Setup some environment for later</div>
<div> resCtx = input.getSubcontext("net.shibboleth.idp.attribute.resolver.context.AttributeResolutionContext", true);</div>
<div> usernameLookupStrategyClass = Java.type("net.shibboleth.idp.session.context.navigate.CanonicalUsernameLookupStrategy");</div>
<div> usernameLookupStrategy = new usernameLookupStrategyClass();</div>
<div> resCtx.setPrincipal(usernameLookupStrategy.apply(input));</div>
<div> stringType = Java.type("net.shibboleth.idp.attribute.StringAttributeValue");</div>
<div><br>
</div>
<div> authCtx = input.getSubcontext("net.shibboleth.idp.authn.context.AuthenticationContext");</div>
<div> mfaCtx = authCtx.getSubcontext("net.shibboleth.idp.authn.context.MultiFactorAuthenticationContext");</div>
<div><br>
</div>
<div> // Fetch Duo attributes</div>
<div> resCtx.getRequestedIdPAttributeNames().add("eduPersonEntitlement");</div>
<div> resCtx.resolveAttributes(custom);</div>
<div> epe = resCtx.getResolvedIdPAttributes().get("eduPersonEntitlement");</div>
<div> // Get SP Entity ID</div>
<div> rpid = profileContext.getSubcontext("net.shibboleth.idp.profile.context.RelyingPartyContext").getRelyingPartyId();</div>
<div><br>
</div>
<div> // Force MFA for SP Entity ID</div>
<div> if( rpid != null )</div>
<div> {</div>
<div> switch( rpid )</div>
<div> {</div>
<div> case "box.net":</div>
<div> nextFlow = "authn/Duo"; break;</div>
<div> case "https://ca1.qualtrics.com":</div>
<div> nextFlow = "authn/Duo"; break;</div>
<div> case "https://jostle.us":</div>
nextFlow = "authn/Duo"; break;<br>
</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
default:
<div> if( mfaCtx.isAcceptable() )</div>
<div> {</div>
<div> nextFlow = null</div>
<div> }</div>
<div> else</div>
<div> {</div>
<div> nextFlow = "authn/Duo"</div>
<div> }</div>
<div> break;</div>
<div> }</div>
<div> }</div>
<div><br>
</div>
<div> // Entitlement group excepted from Duo</div>
<div> if( epe != null && epe.getValues().contains(new stringType("https://shibboleth.uic.edu/entitlement/shibexemptfromduo")) )</div>
<div> {</div>
<div> if( mfaCtx.isAcceptable() )</div>
<div> {</div>
<div> nextFlow = null;</div>
<div> }</div>
<div> }</div>
<div><br>
</div>
<div> input.removeSubcontext(resCtx); // cleanup</div>
<div><br>
</div>
<div> nextFlow; // pass control to second factor or end with the first</div>
<div> ]]></div>
<div> </value></div>
<div> </constructor-arg></div>
<span> </bean></span><br>
</div>
<div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="Signature">
<div>
<div></div>
<div id="divtagdefaultwrapper" style="font-size:12pt; color:#000000; background-color:#FFFFFF; font-family:Calibri,Arial,Helvetica,sans-serif">
<div style="font-family:Tahoma; font-size:13px">---
<div><span id="ms-rterangepaste-start"></span><span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Roberto Ullfig - rullfig@uic.edu</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Systems Administrator</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">Enterprise Applications & Services | Technology Solutions</span><br style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">
<span style="font-family:arial,helvetica,sans-serif; font-size:13px; line-height:16.003px">University of Illinois - Chicago</span>
<div><span id="ms-rterangepaste-end"></span></div>
</div>
</div>
</div>
</div>
</div>
</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Wessel, Keith <kwessel@illinois.edu><br>
<b>Sent:</b> Friday, August 13, 2021 12:02 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> RE: Forcing MFA for some SPs and not Others</font>
<div> </div>
</div>
<style>
<!--
@font-face
{font-family:"Cambria Math"}
@font-face
{font-family:Calibri}
@font-face
{font-family:Tahoma}
p.x_MsoNormal, li.x_MsoNormal, div.x_MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif}
a:link, span.x_MsoHyperlink
{color:#0563C1;
text-decoration:underline}
span.x_EmailStyle20
{font-family:"Calibri",sans-serif;
color:windowtext}
.x_MsoChpDefault
{font-size:10.0pt}
@page WordSection1
{margin:1.0in 1.0in 1.0in 1.0in}
div.x_WordSection1
{}
-->
</style>
<div lang="EN-US" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="x_WordSection1">
<p class="x_MsoNormal">That’s not true if you hve MFA configured properly. The second MFA should see that the currently satisfied authentication methods isn’t sufficient and should prompt the user for step-up authentication. That is, it’ll skip asking the user
for their username and password again but will go straight to the MFA prompt.</p>
<p class="x_MsoNormal"> </p>
<p class="x_MsoNormal">Keith</p>
<p class="x_MsoNormal"> </p>
<p class="x_MsoNormal"> </p>
<div>
<div style="border:none; border-top:solid #E1E1E1 1.0pt; padding:3.0pt 0in 0in 0in">
<p class="x_MsoNormal"><b>From:</b> users <users-bounces@shibboleth.net> <b>On Behalf Of
</b>Ullfig, Roberto Alfredo<br>
<b>Sent:</b> Friday, August 13, 2021 11:56 AM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Forcing MFA for some SPs and not Others</p>
</div>
</div>
<p class="x_MsoNormal"> </p>
<div>
<p class="x_MsoNormal"><span style="font-size:12.0pt; color:black">Is there a way for Shibboleth to create different cookies for different SPs? For instance, if I force MFA on an application on the IDP side I can easily get around MFA by logging into another
SP that doesn't require MFA first because I've already identified myself.</span></p>
</div>
<div>
<div>
<p class="x_MsoNormal"><span style="font-size:12.0pt; color:black"> </span></p>
</div>
<div id="x_Signature">
<div>
<div id="x_divtagdefaultwrapper">
<div>
<p class="x_MsoNormal" style="background:white"><span style="font-size:10.0pt; font-family:"Tahoma",sans-serif; color:black">---
</span></p>
<div>
<p class="x_MsoNormal" style="background:white"><span style="font-size:10.0pt; font-family:"Arial",sans-serif; color:black">Roberto Ullfig -
<a href="mailto:rullfig@uic.edu">rullfig@uic.edu</a><br>
Systems Administrator<br>
Enterprise Applications & Services | Technology Solutions<br>
University of Illinois - Chicago</span><span style="font-size:10.0pt; font-family:"Tahoma",sans-serif; color:black">
</span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>