<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">
<div style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">
Hello,
<div>I am running into an issue that others have had, but I have not been able to find a satisfactory answer. A client wants to require Duo MFA for a SP, and we typically do that by <span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);"><span class="ui-provider brf brg brh bri brj brk brl brm brn bro brp brq brr brs brt bru brv brw brx bry brz bsa bsb bsc bsd bse bsf bsg bsh bsi bsj bsk bsl bsm bsn" dir="ltr">adding
a RelyingPartyOverride for the SP where we set the defaultAuthenticationMethods property to include our local MFA class, "<a aria-label="Link http://idp.uvm.edu/ac/classes/mfa"" title="http://idp.uvm.edu/ac/classes/mfa%22" href="http://idp.uvm.edu/ac/classes/mfa%22" rel="noreferrer noopener" target="_blank" class="fui-Link ___10kug0w f3rmtva f1ewtqcl fyind8e f1k6fduh f1w7gpdv fk6fouc fjoy568 figsok6 f1hu3pq6 f11qmguv f19f4twv f1tyq0we f1g0x7ka fhxju0i f1qch9an f1cnd47f fqv5qza f1vmzxwi f1o700av f13mvf36 f1cmlufx f9n3di6 f1ids18y f1tx3yz7 f1deo86v f1eh06m1 f1iescvh fhgqx19 f1olyrje f1p93eir f1nev41a f1h8hb77 f1lqvz6u f10aw75t fsle3fq f17ae5zn" style="overflow-wrap: break-word;">http://idp.uvm.edu/ac/classes/mfa"</a></span></span>.
However this particular SP is sending <span style="caret-color: rgb(0, 0, 0);">urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport as the </span>AuthnContextClass, which is bypassing the defaultAuthenticationMethods property. From what I can
gather, the SP is asking for PasswordProtectedTransport, the IDP is able to satisfy that requirement, so it succeeds with only a password and doesn’t bother to check the second factor. </div>
<div><br>
</div>
<div>Things I have tried:</div>
<div>- Specifying the MFA flow in relying-party.xml with p:authenticationFlows=“MFA”. No change to behavior</div>
<div>- Added the <span class="token tag attr-name namespace" style="white-space: pre; caret-color: rgb(0, 0, 0);">p:</span><span class="token tag attr-name" style="white-space: pre; caret-color: rgb(0, 0, 0);">disallowedFeatures-ref</span><span class="token tag attr-value punctuation attr-equals" style="white-space: pre; caret-color: rgb(0, 0, 0);">=</span><span class="token tag attr-value punctuation" style="white-space: pre; caret-color: rgb(0, 0, 0);">"</span><span class="token tag attr-value" style="white-space: pre; caret-color: rgb(0, 0, 0);">SAML2.SSO.FEATURE_AUTHNCONTEXT</span><span class="token tag attr-value punctuation" style="white-space: pre; caret-color: rgb(0, 0, 0);">”
in relying-party.xml. Authentication flow ends with an error as expected. We don’t want the flow to end in error, we would like to override the SP request.</span></div>
<div><span class="token tag attr-value punctuation" style="white-space: pre; caret-color: rgb(0, 0, 0);">- Added a transition map to mfa-authn-config.xml for Password flows to try to force the checkSecondFactor script. No change in behavior.</span></div>
<div><span class="token tag attr-value punctuation" style="white-space: pre; caret-color: rgb(0, 0, 0);"></span><entry key="authn/Password”> </div>
<div><span class="Apple-tab-span" style="white-space: pre;"></span> <bean parent="shibboleth.authn.MFA.Transition" p:nextFlowStrategy-ref="checkSecondFactor" /> </div>
<div><span class="Apple-tab-span" style="white-space: pre;"></span> </entry></div>
<div>- Changed idp.authn.flows to only contain MFA. No change in behavior.</div>
<div><br>
</div>
<div>I have asked the client to have the SP remove the AuthnContextClass, but they are hesitant to change anything on the SP side since they are close to go live. Regardless, I would like to prevent service providers from being able to bypass MFA by specifying
an AuthnContextClass. </div>
<div><br>
</div>
<div>Thank you in advance for any suggestions!</div>
<div><br>
</div>
<div>__________________________________<br>
Katy Czar<br>
Systems Architecture & Admin<br>
University of Vermont<br>
<a href="mailto:kczar@uvm.edu">kczar@uvm.edu</a></div>
</div>
</body>
</html>