<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I think I can answer my own question... The only flow I have enabled (idp.authn.flows=MFA) is the MFA flow. If a request specifies an accRef not in its list of supportedPrincipals, it should return a SAML error. If a request does not specify an accRef, the
MFA flow will run and one of the accRefs will return depending whether Duo was performed or not.</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
There should be no practical effect if I remove the defaultAuthenticationMethods setting.</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Do I have that correct? <span id="🙂">🙂</span><br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Andy<br>
</div>
<div>
<div id="appendonsend"></div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Andrew Jason Morgan <morgan@oregonstate.edu><br>
<b>Sent:</b> Wednesday, November 24, 2021 5:26 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: MDDriven overrides for defaultAuthenticationMethods</font>
<div> </div>
</div>
<div dir="ltr">
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
It <b>seems</b>​ like I should be able to remove my defaultAuthenticationMethods setting from the DefaultRelyingParty. Our authn/MFA flow has:</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<property name="supportedPrincipals">
<div> <list></div>
<div> <bean parent="shibboleth.SAML2AuthnContextClassRef"</div>
<div> c:classRef="https://refeds.org/profile/mfa" /></div>
<div> <bean parent="shibboleth.SAML2AuthnContextClassRef"</div>
<div> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" /></div>
<div> <bean parent="shibboleth.SAML2AuthnContextClassRef"</div>
<div> c:classRef="urn:oasis:names:tc:SAML:2.0:ac:classes:Password" /></div>
<div> </list></div>
</property><br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
and defaultAuthenticationMethods allows "https://refeds.org/profile/mfa" and "urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport".</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
What happens if an SP requests an accRef that is not in the authn/MFA supportedPrincipals list? We have idp.authn.flows=MFA, and it uses the authn/Password and authn/Duo flows internally.</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Thanks,</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
Andy</div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<div>
<div id="x_appendonsend"></div>
<div style="font-family:Arial,Helvetica,sans-serif; font-size:12pt; color:rgb(0,0,0)">
<br>
</div>
<hr tabindex="-1" style="display:inline-block; width:98%">
<div id="x_divRplyFwdMsg" dir="ltr"><font style="font-size:11pt" face="Calibri, sans-serif" color="#000000"><b>From:</b> users <users-bounces@shibboleth.net> on behalf of Cantor, Scott <cantor.2@osu.edu><br>
<b>Sent:</b> Wednesday, November 24, 2021 4:14 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: MDDriven overrides for defaultAuthenticationMethods</font>
<div> </div>
</div>
<div class="x_BodyFragment"><font size="2"><span style="font-size:11pt">
<div class="x_PlainText">[This email originated from outside of OSU. Use caution with links and attachments.]<br>
<br>
On 11/24/21, 6:23 PM, "users on behalf of Andrew Jason Morgan" <users-bounces@shibboleth.net on behalf of morgan@oregonstate.edu> wrote:<br>
<br>
> What happens if I don't set defaultAuthenticationMethods in the DefaultRelyingParty? I have<br>
> idp.authn.flows=MFA, and I have defined the supportedPrincipals for authn/MFA. Do I need to "turn off"<br>
> other flows at all? I wonder if my defaultAuthenticationMethods setting is just vestigial at this point....<br>
<br>
They're for different purposes. The supportedPrincipals property of a login method determines what that method supports so that if something is requested, it knows whether it should try that flow. It generally also auto-populates the result of the flow with
those classes.<br>
<br>
The defaultAuthenticationMethods property is an IdP-side imposition of a requirement that takes the place of an SP requesting something and is basically in SAML terms the same as if the SP requested an exact match of one of those classes.<br>
<br>
Setting anything on the DefaultRelyingParty beans applies if there's no override that directs it to use a different configuration. An override could take effect, and if metadata is involved, the metadata would apply, but only if the override did. Otherwise
the default would apply and the explicit setting there would win.<br>
<br>
Combining things gets tricky, but is deterministic.<br>
<br>
-- Scott<br>
<br>
<br>
--<br>
For Consortium Member technical support, see <a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fx%2FZYEpPw&data=04%7C01%7Cmorgan%40oregonstate.edu%7Cf8cc5bf3f4f148f20c5e08d9afb2955f%7Cce6d05e13c5e4d6287a84c4a2713c113%7C0%7C0%7C637734004214970362%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=JxkQWjRDWQc6I2FT1WrXYzkMsoSzc%2FAK63Z45mlefWA%3D&reserved=0" originalsrc="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" shash="mEkZovzw3RZMw9hDeh9BGmWjWOV4zcHBDeHgODWPpzU2ULNfb4mnYU9I3mlZAMFArN05JnDkpXr6p8hIFYYamOGqSV2Vbw8Mv2mrQmjS2tpf/wgy0WMHUOxNmC6C+XS9vkVUV77ZtgGQVNRM7mXxg3IKhuBJZTmiN6ook9nnYmE=">
https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fshibboleth.atlassian.net%2Fwiki%2Fx%2FZYEpPw&data=04%7C01%7Cmorgan%40oregonstate.edu%7Ce4e0cddf4b2d4e81a1f308d9afa8988d%7Cce6d05e13c5e4d6287a84c4a2713c113%7C0%7C0%7C637733960914345267%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=fjzT5q%2FO357W8HS5nq073dfILFfTuqKdtOSndYJXkp8%3D&reserved=0</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</span></font></div>
</div>
</div>
</div>
</body>
</html>