<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
We started using metadata-driven configuration for new SSO setups a while ago, but we still have some relying-party.xml overrides in place for SPs that we haven't migrated to metadata-driven configuration yet. I setup a new SP recently (metadata-driven config)
that requires MFA, but my testing shows that the MFA requirement is not being enforced. As I played around with the configuration, I learned that the metadata config is not overriding the DefaultRelyingParty configuration for defaultAuthenticationMethods
in relying-party.xml. Here is the snippet from relying-party.xml:</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<bean parent="SAML2.SSO.MDDriven" p:postAuthenticationFlows="#{{'duoman-warn', 'context-check'}}">
<div> <property name="defaultAuthenticationMethods"></div>
<div> <list></div>
<div> <ref bean="MFASAML2Principal" /></div>
<div> <ref bean="PasswordPrincipal" /></div>
<div> </list></div>
<div> </property></div>
</bean></div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
where those methods are:</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<!-- MFA authenticationContextClass setup -->
<div> <bean id="MFASAML2Principal" parent="shibboleth.SAML2AuthnContextClassRef" c:classRef="https://refeds.org/profile/mfa" /></div>
<div><br>
</div>
<div> <!-- PasswordProtectedTransport authenticationContextClass setup --></div>
<bean id="PasswordPrincipal" parent="shibboleth.SAML2AuthnContextClassRef" c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" /></div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
The SP metadata contains the exact text from the wiki to set defaultAuthenticationMethods:</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<Extensions>
<div> <mdattr:EntityAttributes></div>
<div> <saml:Attribute Name="http://shibboleth.net/ns/attributes/releaseAllValues" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"></div>
<div> <saml:AttributeValue>eduPersonPrincipalName</saml:AttributeValue></div>
<div> </saml:Attribute></div>
<div> <saml:Attribute Name="http://shibboleth.net/ns/profiles/defaultAuthenticationMethods" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"></div>
<div> <saml:AttributeValue>https://refeds.org/profile/mfa</saml:AttributeValue></div>
<div> </saml:Attribute></div>
<div> <!-- The disallowedFeatures setting is a bitmask, and 0x1 blocks SPs requesting authentication types. --></div>
<div> <saml:Attribute Name="http://shibboleth.net/ns/profiles/disallowedFeatures" NameFormat="urn:oasis:names:tc:SAML:2.0:attrname-format:uri"></div>
<div> <saml:AttributeValue>0x1</saml:AttributeValue></div>
<div> </saml:Attribute></div>
<div> </mdattr:EntityAttributes></div>
</Extensions></div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
If I comment out the defaultAuthenticationMethods from the DefaultRelyingParty config, MFA is enforced correctly.</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Is this the expected behavior?</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Maybe I don't need to set defaultAuthenticationMethods in the DefaultRelyingParty anyway...</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks,</div>
<div>
<div id="Signature">
<div>
<div></div>
<div></div>
<div></div>
<div><span style="font-family:Arial,Helvetica,sans-serif; font-size:12pt">Andy Morgan, Identity & Access Management, IT Operations and Identity</span></div>
<div><span style="font-family:Arial,Helvetica,sans-serif; font-size:12pt">Oregon State University | University Information and Technology | 541-737-8877</span><span style="font-family:Verdana,Geneva,sans-serif; font-size:11pt"><br>
</span></div>
</div>
</div>
</div>
</body>
</html>