<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><br id="lineBreakAtBeginningOfMessage"><div><br><blockquote type="cite"><div>On Mar 7, 2025, at 12:16 PM, Zico <mailzico@gmail.com> wrote:</div><br class="Apple-interchange-newline"><div><meta charset="UTF-8"><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 20px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">Thanks for the quick reply! So, if I understand correctly, a relying party override is my only option to force MFA for<span class="Apple-converted-space"> </span></span><a href="http://research.gov/" style="font-family: Helvetica; font-size: 20px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">Research.gov</a><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 20px; font-style: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;">, even though they don't explicitly request it? Could you point me to any documentation or examples on how to implement this override in Shibboleth IDP?</span></div></blockquote><br></div><div>You could apply a metadata filter to your InCommon metadata config, or you can add something similar to the following in your relying-party.xml file's overrides section, as you would for any other kind of override:</div><div><br></div><div><div> <bean parent="RelyingPartyByName" c:relyingPartyIds="#{{</div><div> 'https://identity.research.gov/sso/sp',</div><div> 'https://identity.acpt.research.gov/sso/sp'</div><div> }}" ></div><div> <property name="profileConfigurations"></div><div> <list></div><div> <bean parent="SAML2.SSO" ></div><div><span class="Apple-tab-span" style="white-space:pre"> </span> <property name="defaultAuthenticationMethods"></div><div><span class="Apple-tab-span" style="white-space:pre"> </span> <bean parent="shibboleth.SAML2AuthnContextClassRef"</div><div><span class="Apple-tab-span" style="white-space:pre"> </span> c:classRef="https://refeds.org/profile/mfa" /></div><div><span class="Apple-tab-span" style="white-space:pre"> </span> </property></div><div> </bean></div><div><span class="Apple-tab-span" style="white-space:pre"> </span> <ref bean="SAML2.Logout" /></div><div> </list></div><div> </property></div><div> </bean></div></div><br><div>
<div>--<br>Michael A. Grady<br>IAM Architect, Unicon, Inc.</div><div><br></div><br class="Apple-interchange-newline">
</div>
<br></body></html>