<div dir="ltr"><div dir="ltr">Thank you!<div><br></div><div>I got it to work in the TransitionMap, like this, but still have a question!</div><div><br></div><div><div style="color:rgb(101,123,131);background-color:rgb(253,246,227);font-family:Consolas,"Courier New",monospace;font-size:14px;line-height:19px;white-space:pre"><div></div><div> <span style="color:rgb(147,161,161)"><</span><span style="color:rgb(38,139,210)">bean</span> <span style="color:rgb(147,161,161)">id</span>=<span style="color:rgb(42,161,152)">"checkSecondFactor"</span> <span style="color:rgb(147,161,161)">parent</span>=<span style="color:rgb(42,161,152)">"shibboleth.ContextFunctions.Scripted"</span></div><div> <span style="color:rgb(147,161,161)">factory-method</span>=<span style="color:rgb(42,161,152)">"inlineScript"</span><span style="color:rgb(147,161,161)">></span></div><div> <span style="color:rgb(147,161,161)"><</span><span style="color:rgb(38,139,210)">constructor-arg</span><span style="color:rgb(147,161,161)">></span></div><div> <span style="color:rgb(147,161,161)"><</span><span style="color:rgb(38,139,210)">value</span><span style="color:rgb(147,161,161)">></span></div><div> <span style="color:rgb(42,161,152)"><![CDATA[</span></div><div><span style="color:rgb(42,161,152)"> DUO_SPs = Java.type("java.util.Arrays").asList("<a href="https://gitlab.cua.edu">https://gitlab.cua.edu</a>");</span></div><div><span style="color:rgb(42,161,152)"> rpid = profileContext.getSubcontext("net.shibboleth.idp.profile.context.RelyingPartyContext").getRelyingPartyId();</span></div><div><span style="color:rgb(42,161,152)"> logger = Java.type("org.slf4j.LoggerFactory").getLogger("checkSecondFactor");</span></div><div><span style="color:rgb(42,161,152)"> <a href="http://logger.info">logger.info</a>('Checking SP: ' + rpid);</span></div><div><span style="color:rgb(42,161,152)"> if (DUO_SPs.contains(rpid)) {</span></div><div><span style="color:rgb(42,161,152)"> nextFlow = "authn/DuoOIDC";</span></div><div><span style="color:rgb(42,161,152)"> } else {</span></div><div><span style="color:rgb(42,161,152)"> nextFlow = null;</span></div><div><span style="color:rgb(42,161,152)"> }</span></div><div><span style="color:rgb(42,161,152)"> nextFlow;</span></div><div><span style="color:rgb(42,161,152)"> ]]></span></div><div> <span style="color:rgb(147,161,161)"></</span><span style="color:rgb(38,139,210)">value</span><span style="color:rgb(147,161,161)">></span></div><div> <span style="color:rgb(147,161,161)"></</span><span style="color:rgb(38,139,210)">constructor-arg</span><span style="color:rgb(147,161,161)">></span></div><div> <span style="color:rgb(147,161,161)"></</span><span style="color:rgb(38,139,210)">bean</span><span style="color:rgb(147,161,161)">></span></div></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr"><br></div><div class="gmail_attr">This enforces MFA for the SP, but only if the user did not login any ohter SP before!</div><div class="gmail_attr"><br></div><div class="gmail_attr">How do I require MFA even when user has a valid session already?</div><div class="gmail_attr"><br></div><div class="gmail_attr">Thank you so much!</div><div class="gmail_attr">Mohamed!</div><div dir="ltr" class="gmail_attr"><br></div><div dir="ltr" class="gmail_attr"><br></div><div dir="ltr" class="gmail_attr">On Wed, Mar 1, 2023 at 10:55 AM Christopher Bongaarts via users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">You may want to consult this page from the docs:<br>
<br>
<a href="https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631610/MultiFactorAuthnConfiguration" rel="noreferrer" target="_blank">https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631610/MultiFactorAuthnConfiguration</a><br>
<br>
The example "Conditional use of two factors, Flow1 and Flow2" may be <br>
useful for your use case; instead of a scripted checkSecondFactor bean, <br>
you should be able to compose some built-in beans (see <br>
<a href="https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631700/PredefinedBeans" rel="noreferrer" target="_blank">https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631700/PredefinedBeans</a> <br>
for the list), in particular shibboleth.Conditions.RelyingPartyId to <br>
check for particular SP entity IDs.<br>
<br>
<br>
On 3/1/2023 9:28 AM, Mohamed Lrhazi via users wrote:<br>
> Hello,<br>
><br>
> I enabled MFA and DUO, following the plugin documentation, latest IdP <br>
> and plugin versions... and it worked... but it is enabled for all <br>
> SPs.... How can I enable it only for specific service providers?<br>
><br>
> Thanks a lot,<br>
> Mohamed.<br>
><br>
<br>
-- <br>
%% Christopher A. Bongaarts %% <a href="mailto:cab@umn.edu" target="_blank">cab@umn.edu</a> %%<br>
%% OIT - Identity Management %% <a href="http://umn.edu/~cab" rel="noreferrer" target="_blank">http://umn.edu/~cab</a> %%<br>
%% University of Minnesota %% +1 (612) 625-1809 %%<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" rel="noreferrer" target="_blank">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div></div>