<div dir="ltr"><div dir="ltr">Based on my reading of those logs, the exit status of the DuoOIDC plugin appears to be "proceed", so the DuoOIDC plugin does not have issues with the factor used.<div><br></div><div>If it should have rejected the Duo response, there would be some configuration required of the DuoOIDC plugin ( idp.duo.oidc.passwordless.allowedFactors).</div><div><br></div><div>That said, the exit status of the DuoPlugin will only be based on the Duo authentication. If you wanted (or needed) to check some additional items after that Authentication stage completes and before things are finalized, you would need to define another step linked to the "proceed" event.</div><div><br></div><div>I'll defer to Scotts answer on whether it's better to remove the requirement from the SP or try to deal with it on the IDP.... </div><div><br></div><div>Steve.</div><div><div><div><br></div></div></div></div><br><div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Wed, Mar 11, 2026 at 4:17 PM Mak, Steven <<a href="mailto:makst@upenn.edu">makst@upenn.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">
<div>
<div style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
I can send more debug logs. I was hoping to keep the email "light" at first.</div>
<div style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
The background to this error is that my DuoOIDC flow currently only supports refeds/mfa + TimeSyncToken authContext principals. We integrate with a fair amount of SPs that add RequestedAuthnContext of minimum PasswordProtectedTransport. In our testing when
we complete a passwordless authentication our principals available in the MFA flow do not include PPT. Our IdP then returns an error response status of NoAuthnContext.</div>
<div style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Here are more logs:</div>
<div style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<blockquote style="margin-left:0.5em;padding-left:0.4em;border-left:3px solid rgb(200,200,200)">
<div style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
2026-03-11 16:11:48,467 - DEBUG [net.shibboleth.idp.plugin.authn.duo.impl.PostValidatePasswordlessEvaluation:201] - Profile Action PostValidatePasswordlessEvaluation: Refreshing passwordless cookie for '<username redacted>' if set</div>
<div style="font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
2026-03-11 16:11:48,471 - DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:196] - Profile Action TransitionMultiFactorAuthentication: Preserving authentication result from 'authn/DuoOIDC' flow</div>
<div style="font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
2026-03-11 16:11:48,472 - DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:213] - Profile Action TransitionMultiFactorAuthentication: Applying MFA transition rule to exit state 'authn/DuoOIDC'</div>
<div style="font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
2026-03-11 16:11:48,472 - DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:241] - Profile Action TransitionMultiFactorAuthentication: MFA flow completing with event 'proceed'</div>
<div style="font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
2026-03-11 16:11:48,474 - DEBUG [net.shibboleth.idp.authn.impl.FinalizeMultiFactorAuthentication:187] - Profile Action FinalizeMultiFactorAuthentication: MFA complete, producing merged result</div>
<div style="font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
2026-03-11 16:11:48,477 - DEBUG [net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext:118] - Profile Action PopulateSubjectCanonicalizationContext: Installing 13 c14n flows into SubjectCanonicalizationContext</div>
<div style="font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
2026-03-11 16:11:48,545 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:91] - Profile Action SelectSubjectCanonicalizationFlow: Selecting c14n descriptor c14n/simple (Inline implementation)</div>
<div style="font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
2026-03-11 16:11:48,545 - DEBUG [net.shibboleth.idp.authn.AbstractSubjectCanonicalizer:172] - SubjectCanonicalizer c14n/simple: trimming whitespace of input string '<username redacted>'</div>
<div style="font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
2026-03-11 16:11:48,546 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:95] - Profile Action SelectSubjectCanonicalizationFlow: Inline c14n implementation c14n/simple completed successfully</div>
<div style="font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
2026-03-11 16:11:48,550 - DEBUG [net.shibboleth.idp.session.impl.DetectIdentitySwitch:142] - Profile Action DetectIdentitySwitch: No previous session found, nothing to do</div>
<div style="font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
2026-03-11 16:11:48,552 - DEBUG [net.shibboleth.idp.authn.impl.FinalizeAuthentication:114] - Profile Action FinalizeAuthentication: Canonical principal name was established as '<username redacted>'</div>
<div style="font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
2026-03-11 16:11:48,553 - DEBUG [net.shibboleth.idp.authn.impl.FinalizeAuthentication:241] - Profile Action FinalizeAuthentication: Checking result for compatibility with operator 'minimum' and principal 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport'</div>
<div style="font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
2026-03-11 16:11:48,555 - DEBUG [net.shibboleth.idp.authn.principal.PrincipalEvalPredicateFactoryRegistry:112] - Registry located predicate factory of type 'net.shibboleth.idp.authn.principal.impl.ExactPrincipalEvalPredicateFactory' for principal type 'class
net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal' and operator 'minimum'</div>
<div style="font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
2026-03-11 16:11:48,557 - WARN [net.shibboleth.idp.authn.impl.FinalizeAuthentication:168] - Profile Action FinalizeAuthentication: Authentication result for flow authn/MFA did not satisfy the request</div>
<div style="font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
2026-03-11 16:11:48,571 - WARN [org.opensaml.profile.action.impl.LogEvent:94] - A non-proceed event occurred while processing the request: RequestUnsupported</div>
<div style="font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
2026-03-11 16:11:48,679 - DEBUG [net.shibboleth.idp.profile.interceptor.impl.PopulateProfileInterceptorContext:138] - Profile Action PopulateProfileInterceptorContext: No outbound interceptor flows active for this request</div>
<div style="font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
2026-03-11 16:11:48,691 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:180] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.messaging.handler.impl.BasicMessageHandlerChain' on OUTBOUND message
context</div>
<div style="font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
2026-03-11 16:11:48,691 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:197] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.ResponseImpl'</div>
<div style="font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
2026-03-11 16:11:48,772 - DEBUG [net.shibboleth.idp.saml.profile.impl.SpringAwareMessageEncoderFactory:76] - Looking up message encoder based on binding URI: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST</div>
<div style="font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
2026-03-11 16:11:48,789 - DEBUG [net.shibboleth.idp.profile.impl.RecordResponseComplete:86] - Profile Action RecordResponseComplete: Record response complete</div>
<div style="font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
2026-03-11 16:11:48,792 - INFO [Shibboleth-Audit.SSO:333] - 2026-03-11T20:11:48.792257086Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_3f500a769a367e7c2a50289bbfaf758c|RPID_Redacted|<a href="http://shibboleth.net/ns/profiles/saml2/sso/browser%7CIdP_redacted%7Curn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST%7C_2b6a9342392d2c1f31c73d837ea8a313%7C%7C%7C%7C%7C%7C" target="_blank">http://shibboleth.net/ns/profiles/saml2/sso/browser|IdP_redacted|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_2b6a9342392d2c1f31c73d837ea8a313||||||</a></div>
</blockquote>
<div style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div id="m_-6235970467889988197mail-editor-reference-message-container" style="color:inherit;background-color:inherit">
<div style="direction:ltr">
</div>
<div style="text-align:left;padding:3pt 0in 0in;border-width:1pt medium medium;border-style:solid none none;border-color:rgb(181,196,223) currentcolor currentcolor;font-family:Aptos;font-size:12pt;color:black">
<b>From: </b>Steven Premeau <<a href="mailto:steven.premeau@maine.edu" target="_blank">steven.premeau@maine.edu</a>><br>
<b>Date: </b>Wednesday, March 11, 2026 at 4:02 PM<br>
<b>To: </b>Shib Users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>><br>
<b>Cc: </b>Mak, Steven <<a href="mailto:makst@upenn.edu" target="_blank">makst@upenn.edu</a>><br>
<b>Subject: </b>Re: DuoOIDC passwordless event handling question<br>
<br>
</div>
<div style="direction:ltr">
Steven - </div>
<div style="direction:ltr">
<br>
</div>
<div style="direction:ltr">
I know that those examples worked when the Passwordless support was released, but it's difficult to debug with the partial configuration.</div>
<div style="direction:ltr">
<br>
</div>
<div style="direction:ltr">
The error you are reporting is occurring after the MFA flow has completed, do you have any (debug) logging that offers up status as the MFA is working? </div>
<div style="direction:ltr">
<br>
</div>
<div style="direction:ltr">
Of note, if the request is including a specific authentication type, it could be that everything is working as you expect, but the end result does not satisfy that requirement..... </div>
<div style="direction:ltr">
<br>
</div>
<div style="direction:ltr">
Steve.</div>
<div style="direction:ltr">
<br>
</div>
<div style="direction:ltr">
<br>
</div>
<div style="direction:ltr">
</div>
<div style="direction:ltr">
<br>
</div>
<div class="gmail_attr" style="direction:ltr">On Wed, Mar 11, 2026 at 3:20 PM Mak, Steven via users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>> wrote:</div>
<blockquote style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left:1px solid rgb(204,204,204)">
<div class="gmail_quote" style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Hello all,</div>
<div class="gmail_quote" style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div class="gmail_quote" style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
In the DuoOIDCPasswordless configuration page there is an example movie where the user is returned to a password prompt screen if the factors are deemed unacceptable. I've read over the "Event Handling" section of the document several times. I've configured
my mfa-authn-config.xml file to watch for these events in the authn/DuoOIDC nextFlowStrategy Map, but my IdP only seems to stop trying once it hits a RequestUnsupported result, instead of proceeding to the script ref I provide.</div>
<div class="gmail_quote" style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div class="gmail_quote" style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Does anyone have an example of how these event handlers are supposed to be wired up?</div>
<div class="gmail_quote" style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div class="gmail_quote" style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Profile Action FinalizeAuthentication: Authentication result for flow authn/MFA did not satisfy the request</div>
<div class="gmail_quote" style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
A non-proceed event occurred while processing the request: RequestUnsupported</div>
<div class="gmail_quote" style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div class="gmail_quote" style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Am I missing some documentation on how to transition to from this event to my script? My checkFirstFactor clears the duoContext and sends the user to authn/Password just like the documented example, but it doesn't work.</div>
<div class="gmail_quote" style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div class="gmail_quote" style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
Here's the nextFlowStrategyMap I have:</div>
<div class="gmail_quote" style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div class="gmail_quote" style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<entry key="authn/DuoOIDC"></div>
<div class="gmail_quote" style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<bean parent="shibboleth.authn.MFA.Transition"></div>
<div class="gmail_quote" style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<property name="nextFlowStrategyMap"></div>
<div class="gmail_quote" style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<map></div>
<div class="gmail_quote" style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<entry key="RequestUnsupported" value-ref="checkFirstFactor"/></div>
<div class="gmail_quote" style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<entry key="ReselectFlow" value-ref="checkFirstFactor"/></div>
<div class="gmail_quote" style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<entry key="IdentitySwitch" value-ref="checkFirstFactor"/></div>
<div class="gmail_quote" style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<entry key="InvalidCredentials" value-ref="checkFirstFactor"/></div>
<div class="gmail_quote" style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
</map></div>
<div class="gmail_quote" style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
</property></div>
<div class="gmail_quote" style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
</bean></div>
<div class="gmail_quote" style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
</entry></div>
<div class="gmail_quote" style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div class="gmail_quote" style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<br>
</div>
<div class="gmail_quote" style="direction:ltr;font-family:Aptos,Arial,Helvetica,sans-serif;font-size:12pt;color:rgb(0,0,0)">
<a href="https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3360686194/DuoOIDCPasswordless__;!!IBzWLUs!QpCXkYfSLLe3ue4U_eCocX1_BbjCpe9f3E7QPWy5lLz7nK0In23ythodnpGdJ0SwX2JLFuw61Qejb49FYXnM6IPhHQ$" target="_blank">https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3360686194/DuoOIDCPasswordless</a></div>
<div class="gmail_quote" style="direction:ltr">--<br>
For Consortium Member technical support, see <a href="https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!IBzWLUs!QpCXkYfSLLe3ue4U_eCocX1_BbjCpe9f3E7QPWy5lLz7nK0In23ythodnpGdJ0SwX2JLFuw61Qejb49FYXnLUP-VEQ$" rel="noreferrer" target="_blank">
https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">
users-unsubscribe@shibboleth.net</a></div>
</blockquote>
</div>
</div>
</blockquote></div></div>