<html><body><div><div dir="ltr">Our IdP triggers Duo MFA based on user-enrollment indicated in assurance attribute (parsed in mfa-authn-config.xml) - i.e., for any relying party.</div><div dir="ltr">That’s worked just fine for years, but I’m now being required to enable exemptions for particular SPs; that is, even if the user is enrolled in Duo MFA, do not require Duo when accessing that SP. (Yes we know it’s not a good idea, especially for the SPs likely to be exempted.)</div><div dir="ltr"><br></div><div dir="ltr">For the sake of current issue, ignore or pretend there are no requests with authn context specified in the incoming request, and there are no relevant contexts other than PPT and REFEDS MFA.</div><div dir="ltr"><br></div><div dir="ltr">The mfa-authn-config.xml logic should look at allowed authn contexts and either proceed normally, relying on the assurance attribute, or override that based on per-entity relying party override in relying-party.xml. I’ve tried to indicate the default behavior, then provide override where necessary, like these snippets from relying-party.xml. I may be doing this part wrong and am asking for correction if so.</div><div><br></div><div><br></div><div><!-- defaultAuthenticationMethods in SAML2.SSO sends authN to MFA flow (per principal names defined in general-authn.xml --></div></div><div><div> <bean id="shibboleth.DefaultRelyingParty" parent="RelyingParty"></div><div> <property name="profileConfigurations"></div><div> <list></div><div> <bean parent="Shibboleth.SSO" /></div><div dir="ltr"> ...</div><div> <bean parent="SAML2.SSO" </div><div> p:defaultAuthenticationMethods="#{{'<a href="https://refeds.org/profile/mfa">https://refeds.org/profile/mfa</a>','urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport'}}" /></div><div dir="ltr"> ...</div><div> </list></div><div> </property></div><div> </bean></div><div><br></div><div> <!-- Container for any overrides you want to add. --></div><div><br></div><div> <util:list id="shibboleth.RelyingPartyOverrides"></div><div><br></div><div><!-- Services requesting PasswordOnly authentication, i.e., bypass Duo MFA even for enrolled users --></div><div><!-- The requested override PPT method/context is used in MFA flow to flag bypass Duo MFA --></div><div><br></div><div> <bean parent="RelyingPartyByName" c:relyingPartyIds="#{{'<a href="https://iam.alaska.edu/shibboleth'}">https://iam.alaska.edu/shibboleth'}</a>}"></div><div> <property name="profileConfigurations"></div><div> <list></div><div> <bean parent="SAML2.SSO" </div><div> p:defaultAuthenticationMethods="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport"</div><div> /></div><div> </list></div><div> </property></div><div> </bean></div></div><div><br></div><div dir="ltr">Thanks !</div><div dir="ltr"><br></div><div dir="ltr">David St. Pierre Bantz</div><div dir="ltr"><br></div></body></html>