<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="word-wrap:break-word">
<div class="WordSection1">
<p class="MsoNormal">Why can’t you make a “check first factor” script that the MFA flow calls first, then have that script check the relying party ID and return the flow where you want ti to go? Much easier than creating a custom flow.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">Keith<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b>From:</b> users <users-bounces@shibboleth.net> <b>On Behalf Of
</b>Mak, David<br>
<b>Sent:</b> Friday, January 14, 2022 9:56 AM<br>
<b>To:</b> users@shibboleth.net<br>
<b>Subject:</b> Any recommendations/validation of a scheme to select a SAML Proxy or Password/MFA authentication flow based on relying party / SP entityID?<o:p></o:p></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:12.0pt;color:black">I've configured SAML Proxy in both IDP 4.0.1 and 4.1.4 in our dev environments, in preparation for some architectural changes within our authentication architecture.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:12.0pt;color:black">We have a need to select an authentication flow based on the entityID of the service provider's/relying parties' SAML request. It will default to SAML Proxy unless the
SP/RP is in a smaller list, in which case we want to use the default MFA authN flow we have which uses the Password and Duo MFA methods.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:12.0pt;color:black">As I see it, I will need to create a custom authN flow that checks the entityID for a match to that list, then continue with either the SAML Proxy or the MFA flows as needed. <o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:12.0pt;color:black">I need to read up on the Spring web flow stuff more, but on first glance, I'm having trouble determining if this is possible with the design I described. It seems the only
end-state is a "proceed" and I can't quite see how a custom authN flow can initiate either a SAML Proxy flow or a MFA authN flow.<o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:12.0pt;color:black">Any advice would be appreciated. Thanks in advance!<o:p></o:p></span></p>
</div>
<div>
<div>
<p class="MsoNormal"><span style="font-size:12.0pt;color:black"><o:p> </o:p></span></p>
</div>
<div id="Signature">
<div>
<div id="divtagdefaultwrapper">
<div>
<p class="MsoNormal" style="background:white"><strong><span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#A00000">David Mak (Pronouns: He/Him/His)</span></strong><span style="font-size:12.0pt;color:#212121"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><strong><span style="font-size:10.0pt;font-family:"Calibri",sans-serif;color:#A00000">Identity Services Specialist</span></strong><span style="font-size:12.0pt;color:#212121"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;color:black">Information Technology Services</span><span style="font-size:12.0pt;color:#212121"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;color:black">Northeastern University</span><span style="font-size:12.0pt;color:#212121"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;color:black">360 Huntington Ave. Boston MA 02115-5000</span><span style="font-size:12.0pt;color:#212121"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;color:black">Mail Stop: 302-216</span><span style="font-size:12.0pt;color:#212121"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;color:black">O:617-373-7836 M:617-840-7543</span><span style="font-size:12.0pt;color:#212121"><o:p></o:p></span></p>
</div>
<div>
<p class="MsoNormal" style="background:white"><span style="font-size:10.0pt;color:#212121"><a href="mailto:%20d.mak@neu.edu">d.mak@northeastern.edu</a></span><span style="font-size:12.0pt;color:#212121"><o:p></o:p></span></p>
</div>
</div>
</div>
</div>
</div>
</div>
</body>
</html>