<div>Thanks, I'll check it out.</div><div><br></div><div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Sat, 8 Mar, 2025 at 12:33 AM, Michael Grady <<a href="mailto:mgrady@unicon.net">mgrady@unicon.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;padding-left:1ex;border-left-color:rgb(204,204,204)"><div style="line-break:after-white-space"><br id="m_-7011623757964262999lineBreakAtBeginningOfMessage"><div><br><blockquote type="cite"><div>On Mar 7, 2025, at 12:16 PM, Zico <<a href="mailto:mailzico@gmail.com" target="_blank">mailzico@gmail.com</a>> wrote:</div><br><div><span style="font-family:Helvetica;font-size:20px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none;float:none;display:inline!important">Thanks for the quick reply!  So, if I understand correctly, a relying party override is my only option to force MFA for<span style="font-family:Helvetica"> </span></span><a href="http://research.gov/" style="font-family:Helvetica;font-size:20px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px" target="_blank">Research.gov</a><span style="font-family:Helvetica;font-size:20px;font-style:normal;font-variant-caps:normal;font-weight:400;letter-spacing:normal;text-align:start;text-indent:0px;text-transform:none;white-space:normal;word-spacing:0px;text-decoration:none;float:none;display:inline!important">, even though they don't explicitly request it?  Could you point me to any documentation or examples on how to implement this override in Shibboleth IDP?</span></div></blockquote><br></div><div>You could apply a metadata filter to your InCommon metadata config, or you can add something similar to the following in your relying-party.xml file's overrides section, as you would for any other kind of override:</div><div><br></div><div><div>        <bean parent="RelyingPartyByName" c:relyingPartyIds="#{{</div><div>            '<a href="https://identity.research.gov/sso/sp" target="_blank">https://identity.research.gov/sso/sp</a>',</div><div>            '<a href="https://identity.acpt.research.gov/sso/sp" target="_blank">https://identity.acpt.research.gov/sso/sp</a>'</div><div>            }}" ></div><div>            <property name="profileConfigurations"></div><div>                <list></div><div>                    <bean parent="SAML2.SSO" ></div><div><span style="white-space:pre-wrap">                 </span>  <property name="defaultAuthenticationMethods"></div><div><span style="white-space:pre-wrap">                        </span>      <bean parent="shibboleth.SAML2AuthnContextClassRef"</div><div><span style="white-space:pre-wrap">                                        </span> c:classRef="<a href="https://refeds.org/profile/mfa" target="_blank">https://refeds.org/profile/mfa</a>" /></div><div><span style="white-space:pre-wrap">                       </span>  </property></div><div>                    </bean></div><div><span style="white-space:pre-wrap">          </span>    <ref bean="SAML2.Logout" /></div><div>                </list></div><div>            </property></div><div>        </bean></div></div></div><div style="line-break:after-white-space"><br><div>
<div>--<br>Michael A. Grady<br>IAM Architect, Unicon, Inc.</div><div><br></div><br>

</div>
<br></div></blockquote></div></div>