<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I can send more debug logs. I was hoping to keep the email "light" at first.</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
The background to this error is that my DuoOIDC flow currently only supports refeds/mfa + TimeSyncToken authContext principals. We integrate with a fair amount of SPs that add RequestedAuthnContext of minimum PasswordProtectedTransport. In our testing when
we complete a passwordless authentication our principals available in the MFA flow do not include PPT. Our IdP then returns an error response status of NoAuthnContext.</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Here are more logs:</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<blockquote style="margin-left: 0.5em; padding-left: 0.4em; border-left-width: 3px; border-left-style: solid; border-left-color: rgb(200, 200, 200);">
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
2026-03-11 16:11:48,467 - DEBUG [net.shibboleth.idp.plugin.authn.duo.impl.PostValidatePasswordlessEvaluation:201] - Profile Action PostValidatePasswordlessEvaluation: Refreshing passwordless cookie for '<username redacted>' if set</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
2026-03-11 16:11:48,471 - DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:196] - Profile Action TransitionMultiFactorAuthentication: Preserving authentication result from 'authn/DuoOIDC' flow</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
2026-03-11 16:11:48,472 - DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:213] - Profile Action TransitionMultiFactorAuthentication: Applying MFA transition rule to exit state 'authn/DuoOIDC'</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
2026-03-11 16:11:48,472 - DEBUG [net.shibboleth.idp.authn.impl.TransitionMultiFactorAuthentication:241] - Profile Action TransitionMultiFactorAuthentication: MFA flow completing with event 'proceed'</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
2026-03-11 16:11:48,474 - DEBUG [net.shibboleth.idp.authn.impl.FinalizeMultiFactorAuthentication:187] - Profile Action FinalizeMultiFactorAuthentication: MFA complete, producing merged result</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
2026-03-11 16:11:48,477 - DEBUG [net.shibboleth.idp.authn.impl.PopulateSubjectCanonicalizationContext:118] - Profile Action PopulateSubjectCanonicalizationContext: Installing 13 c14n flows into SubjectCanonicalizationContext</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
2026-03-11 16:11:48,545 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:91] - Profile Action SelectSubjectCanonicalizationFlow: Selecting c14n descriptor c14n/simple (Inline implementation)</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
2026-03-11 16:11:48,545 - DEBUG [net.shibboleth.idp.authn.AbstractSubjectCanonicalizer:172] - SubjectCanonicalizer c14n/simple: trimming whitespace of input string '<username redacted>'</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
2026-03-11 16:11:48,546 - DEBUG [net.shibboleth.idp.authn.impl.SelectSubjectCanonicalizationFlow:95] - Profile Action SelectSubjectCanonicalizationFlow: Inline c14n implementation c14n/simple completed successfully</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
2026-03-11 16:11:48,550 - DEBUG [net.shibboleth.idp.session.impl.DetectIdentitySwitch:142] - Profile Action DetectIdentitySwitch: No previous session found, nothing to do</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
2026-03-11 16:11:48,552 - DEBUG [net.shibboleth.idp.authn.impl.FinalizeAuthentication:114] - Profile Action FinalizeAuthentication: Canonical principal name was established as '<username redacted>'</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
2026-03-11 16:11:48,553 - DEBUG [net.shibboleth.idp.authn.impl.FinalizeAuthentication:241] - Profile Action FinalizeAuthentication: Checking result for compatibility with operator 'minimum' and principal 'urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport'</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
2026-03-11 16:11:48,555 - DEBUG [net.shibboleth.idp.authn.principal.PrincipalEvalPredicateFactoryRegistry:112] - Registry located predicate factory of type 'net.shibboleth.idp.authn.principal.impl.ExactPrincipalEvalPredicateFactory' for principal type 'class
net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal' and operator 'minimum'</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
2026-03-11 16:11:48,557 - WARN [net.shibboleth.idp.authn.impl.FinalizeAuthentication:168] - Profile Action FinalizeAuthentication: Authentication result for flow authn/MFA did not satisfy the request</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
2026-03-11 16:11:48,571 - WARN [org.opensaml.profile.action.impl.LogEvent:94] - A non-proceed event occurred while processing the request: RequestUnsupported</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
2026-03-11 16:11:48,679 - DEBUG [net.shibboleth.idp.profile.interceptor.impl.PopulateProfileInterceptorContext:138] - Profile Action PopulateProfileInterceptorContext: No outbound interceptor flows active for this request</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
2026-03-11 16:11:48,691 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:180] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler of type 'org.opensaml.messaging.handler.impl.BasicMessageHandlerChain' on OUTBOUND message
context</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
2026-03-11 16:11:48,691 - DEBUG [net.shibboleth.idp.profile.impl.WebFlowMessageHandlerAdaptor:197] - Profile Action WebFlowMessageHandlerAdaptor: Invoking message handler on message context containing a message of type 'org.opensaml.saml.saml2.core.impl.ResponseImpl'</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
2026-03-11 16:11:48,772 - DEBUG [net.shibboleth.idp.saml.profile.impl.SpringAwareMessageEncoderFactory:76] - Looking up message encoder based on binding URI: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
2026-03-11 16:11:48,789 - DEBUG [net.shibboleth.idp.profile.impl.RecordResponseComplete:86] - Profile Action RecordResponseComplete: Record response complete</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
2026-03-11 16:11:48,792 - INFO [Shibboleth-Audit.SSO:333] - 2026-03-11T20:11:48.792257086Z|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect|_3f500a769a367e7c2a50289bbfaf758c|RPID_Redacted|http://shibboleth.net/ns/profiles/saml2/sso/browser|IdP_redacted|urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST|_2b6a9342392d2c1f31c73d837ea8a313||||||</div>
</blockquote>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="mail-editor-reference-message-container" style="color: inherit; background-color: inherit;">
<div class="ms-outlook-mobile-reference-message skipProofing" style="direction: ltr;">
</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="text-align: left; padding: 3pt 0in 0in; border-width: 1pt medium medium; border-style: solid none none; border-color: rgb(181, 196, 223) currentcolor currentcolor; font-family: Aptos; font-size: 12pt; color: black;">
<b>From: </b>Steven Premeau <steven.premeau@maine.edu><br>
<b>Date: </b>Wednesday, March 11, 2026 at 4:02 PM<br>
<b>To: </b>Shib Users <users@shibboleth.net><br>
<b>Cc: </b>Mak, Steven <makst@upenn.edu><br>
<b>Subject: </b>Re: DuoOIDC passwordless event handling question<br>
<br>
</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="direction: ltr;">
Steven - </div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="direction: ltr;">
<br>
</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="direction: ltr;">
I know that those examples worked when the Passwordless support was released, but it's difficult to debug with the partial configuration.</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="direction: ltr;">
<br>
</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="direction: ltr;">
The error you are reporting is occurring after the MFA flow has completed, do you have any (debug) logging that offers up status as the MFA is working? </div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="direction: ltr;">
<br>
</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="direction: ltr;">
Of note, if the request is including a specific authentication type, it could be that everything is working as you expect, but the end result does not satisfy that requirement..... </div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="direction: ltr;">
<br>
</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="direction: ltr;">
Steve.</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="direction: ltr;">
<br>
</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="direction: ltr;">
<br>
</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="direction: ltr;">
</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="direction: ltr;">
<br>
</div>
<div class="gmail_attr" style="direction: ltr;">On Wed, Mar 11, 2026 at 3:20 PM Mak, Steven via users <<a href="mailto:users@shibboleth.net" data-outlook-id="ad8b3dd3-4ec4-4216-ab22-906a22f76509">users@shibboleth.net</a>> wrote:</div>
<blockquote style="margin: 0px 0px 0px 0.8ex; padding-left: 1ex; border-left-width: 1px; border-left-style: solid; border-left-color: rgb(204, 204, 204);">
<div class="gmail_quote" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Hello all,</div>
<div class="gmail_quote" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="gmail_quote" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
In the DuoOIDCPasswordless configuration page there is an example movie where the user is returned to a password prompt screen if the factors are deemed unacceptable. I've read over the "Event Handling" section of the document several times. I've configured
my mfa-authn-config.xml file to watch for these events in the authn/DuoOIDC nextFlowStrategy Map, but my IdP only seems to stop trying once it hits a RequestUnsupported result, instead of proceeding to the script ref I provide.</div>
<div class="gmail_quote" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="gmail_quote" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Does anyone have an example of how these event handlers are supposed to be wired up?</div>
<div class="gmail_quote" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="gmail_quote" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Profile Action FinalizeAuthentication: Authentication result for flow authn/MFA did not satisfy the request</div>
<div class="gmail_quote" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
A non-proceed event occurred while processing the request: RequestUnsupported</div>
<div class="gmail_quote" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="gmail_quote" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Am I missing some documentation on how to transition to from this event to my script? My checkFirstFactor clears the duoContext and sends the user to authn/Password just like the documented example, but it doesn't work.</div>
<div class="gmail_quote" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="gmail_quote" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Here's the nextFlowStrategyMap I have:</div>
<div class="gmail_quote" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="gmail_quote" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<entry key="authn/DuoOIDC"></div>
<div class="gmail_quote" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<bean parent="shibboleth.authn.MFA.Transition"></div>
<div class="gmail_quote" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<property name="nextFlowStrategyMap"></div>
<div class="gmail_quote" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<map></div>
<div class="gmail_quote" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<entry key="RequestUnsupported" value-ref="checkFirstFactor"/></div>
<div class="gmail_quote" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<entry key="ReselectFlow" value-ref="checkFirstFactor"/></div>
<div class="gmail_quote" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<entry key="IdentitySwitch" value-ref="checkFirstFactor"/></div>
<div class="gmail_quote" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<entry key="InvalidCredentials" value-ref="checkFirstFactor"/></div>
<div class="gmail_quote" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
</map></div>
<div class="gmail_quote" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
</property></div>
<div class="gmail_quote" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
</bean></div>
<div class="gmail_quote" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
</entry></div>
<div class="gmail_quote" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="gmail_quote" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="gmail_quote" style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<a href="https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3360686194/DuoOIDCPasswordless__;!!IBzWLUs!QpCXkYfSLLe3ue4U_eCocX1_BbjCpe9f3E7QPWy5lLz7nK0In23ythodnpGdJ0SwX2JLFuw61Qejb49FYXnM6IPhHQ$" target="_blank" data-outlook-id="bc2c252a-7d78-451a-9feb-4bc21e9dac50">https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3360686194/DuoOIDCPasswordless</a></div>
<div class="gmail_quote" style="direction: ltr;">--<br>
For Consortium Member technical support, see <a href="https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!IBzWLUs!QpCXkYfSLLe3ue4U_eCocX1_BbjCpe9f3E7QPWy5lLz7nK0In23ythodnpGdJ0SwX2JLFuw61Qejb49FYXnLUP-VEQ$" target="_blank" rel="noreferrer" data-outlook-id="d9c43894-60a8-4297-a3e5-f2372ce88aba">
https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank" data-outlook-id="34c8547a-a68b-4e51-8cd8-69657c1755fa">
users-unsubscribe@shibboleth.net</a></div>
</blockquote>
</div>
</body>
</html>