<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">On 2/2/2024 7:02 AM, Cantor, Scott
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:4DD32342-2090-4773-8945-108076408073@osu.edu">
<pre><blockquote type="cite" style="color: #007cff;"><pre
class="moz-quote-pre" wrap="">If asked for a specific context, the IdP throws a NoAuthnContext error and
logs indicate that none of the authn flows matched.
</pre></blockquote><pre class="moz-quote-pre" wrap="">If it's running the flow you expect, then the problem is what you're populating in the result and since you're presumably using that hook you asked about to decide what to populate, obviously if that doesn't take into consideration what the SP asked for, it will fail.
OTOH, you can't just tell it what it wants to hear. If you can't meet the requirement, then failure is the expected outcome.
Using hooks to dynamically populate the Subject implies that one is not auto-populating anything based on any other configuration.</pre></pre>
</blockquote>
<p>It's not running any flows; it can't find one that supports that
AuthnContext. I'm pretty sure that implies that my list of
supportedPrincipals from authn.properties is either not being used
or I've typoed something. Maybe I have some legacy v3 or v2
config that is blocking it. Requesting either the <a class="moz-txt-link-abbreviated" href="http://www.umn.edu">www.umn.edu</a>
class or the REFEDS class results in the same error (haven't tried
PPT yet but don't really care about that case in the Real World,
just for the sake of debugging).<br>
</p>
<p><font face="monospace">idp.authn.SAML.supportedPrincipals = \<br>
urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport,
\<br>
urn:oasis:names:tc:SAML:2.0:ac:classes:Password, \<br>
<a class="moz-txt-link-freetext" href="https://www.umn.edu/shibboleth/classes/authncontext/duo">https://www.umn.edu/shibboleth/classes/authncontext/duo</a>, \<br>
<a class="moz-txt-link-freetext" href="https://refeds.org/profile/mfa">https://refeds.org/profile/mfa</a><br>
</font><br>
</p>
<p><font face="monospace">2024-02-02 10:28:59,668 - 128.101.xx.yy -
DEBUG
[net.shibboleth.idp.profile.impl.SelectRelyingPartyConfiguration:136]
- Profile Action SelectRelyingPartyConfiguration: Found relying
party configuration shibboleth.DefaultRelyingParty for request<br>
2024-02-02 10:28:59,740 - 128.101.xx.yy - DEBUG
[net.shibboleth.idp.saml.saml2.profile.impl.ProcessRequestedAuthnContext:221]
- Profile Action ProcessRequestedAuthnContext:
RequestedPrincipalContext created with operator exact and 1
custom principal(s)<br>
2024-02-02 10:28:59,744 - 128.101.xx.yy - DEBUG
[net.shibboleth.idp.authn.impl.PopulateAuthenticationContext:215]
- Profile Action PopulateAuthenticationContext: Installed 1
potential authentication flows into AuthenticationContext<br>
2024-02-02 10:28:59,757 - 128.101.xx.yy - DEBUG
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:401] -
Profile Action SelectAuthenticationFlow: Specific principals
requested with 'exact' operator:
[AuthnContextClassRefPrincipal{authnContextClassRef=<a class="moz-txt-link-freetext" href="https://refeds.org/profile/mfa">https://refeds.org/profile/mfa</a>}]<br>
2024-02-02 10:28:59,757 - 128.101.xx.yy - DEBUG
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:409] -
Profile Action SelectAuthenticationFlow: No active results
available, selecting an inactive flow<br>
2024-02-02 10:28:59,757 - 128.101.xx.yy - DEBUG
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:431] -
Profile Action SelectAuthenticationFlow: Checking for inactive
flow compatible with operator 'exact' and principal
'<a class="moz-txt-link-freetext" href="https://refeds.org/profile/mfa">https://refeds.org/profile/mfa</a>'<br>
2024-02-02 10:28:59,757 - 128.101.xx.yy - DEBUG
[net.shibboleth.idp.authn.principal.PrincipalEvalPredicateFactoryRegistry:126]
- Registry located predicate factory of type
'net.shibboleth.idp.authn.principal.impl.ExactPrincipalEvalPredicateFactory'
for principal type 'class
net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal'
and operator 'exact'<br>
2024-02-02 10:28:59,757 - 128.101.xx.yy - INFO
[net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:455] -
Profile Action SelectAuthenticationFlow: None of the potential
authentication flows can satisfy the request<br>
2024-02-02 10:28:59,757 - 128.101.xx.yy - DEBUG
[org.springframework.webflow.execution.ActionExecutor:53] -
Finished executing
net.shibboleth.idp.authn.impl.SelectAuthenticationFlow@19a0b241;
result = RequestUnsupported</font><br>
<br>
</p>
<pre class="moz-signature" cols="72">--
%% Christopher A. Bongaarts %% <a class="moz-txt-link-abbreviated" href="mailto:cab@umn.edu">cab@umn.edu</a> %%
%% OIT - Identity Management %% <a class="moz-txt-link-freetext" href="http://umn.edu/~cab">http://umn.edu/~cab</a> %%
%% University of Minnesota %% +1 (612) 625-1809 %%
</pre>
</body>
</html>