<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: "Consolas", "Courier", monospace; font-size: 12pt; color: rgb(0, 0, 0);">
Hi list!</div>
<div class="elementToProof" style="font-family: "Consolas", "Courier", monospace; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: "Consolas", "Courier", monospace; font-size: 12pt; color: rgb(0, 0, 0);">
Now that Duo returns amr values with the "second factor" authn, I'm interested in passing them along to client apps. This brings three questions to mind: </div>
<ol start="1" style="margin-top: 0px; margin-bottom: 0px; list-style-type: decimal;" data-editing-info="{"applyListStyleFromLevel":false,"orderedStyleType":1}">
<li style="font-family: "Consolas", "Courier", monospace; font-size: 12pt; color: rgb(0, 0, 0); margin-top: 0px; margin-bottom: 0px;">
<div class="elementToProof" role="presentation">How do I tell Shib to release the amr claim or not?</div>
</li><li style="font-family: "Consolas", "Courier", monospace; font-size: 12pt; color: rgb(0, 0, 0); margin-top: 0px; margin-bottom: 0px;">
<div class="elementToProof" role="presentation">How do I tell Shib to include "pwd" and whatever Duo returned?</div>
</li><li style="font-family: "Consolas", "Courier", monospace; font-size: 12pt; color: rgb(0, 0, 0); margin-top: 0px; margin-bottom: 0px;">
<div class="elementToProof" role="presentation">Can I create an IdP attribute from this data to expose to SAML clients?</div>
</li></ol>
<div style="margin-top: 0px; margin-bottom: 0px; font-family: "Consolas", "Courier", monospace; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="margin-top: 0px; margin-bottom: 0px; font-family: "Consolas", "Courier", monospace; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
I'm on Shib IdP v5.2.3 with net.shibboleth.idp.plugin.authn.duo.nimbus Version 2.3.0, and every authn is funneled through the MFA flow, with a script that chooses whether or not to continue on to Duo. </div>
<div style="margin-top: 0px; margin-bottom: 0px; font-family: "Consolas", "Courier", monospace; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="margin-top: 0px; margin-bottom: 0px; font-family: "Consolas", "Courier", monospace; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
The background is that some SaaS apps are now "requiring" that "admins" use phishing resistant mfa. Being the same login as for non-admins, the client can't request specific acr/amr values. We force those apps to the refeds/mfa profile, so everyone must do
password + duo for the SP. We have two duo integrations, and one requires "phishing reistant mfa" in Duo's configuration, and we choose based on user attrs (groups from grouper via ldap) and the SP entity ID / client id. We'd like to be able to pass the
authentication methods actually performed on to clients who don't request the correct ones (or any like in SAML). </div>
<div style="margin-top: 0px; margin-bottom: 0px; font-family: "Consolas", "Courier", monospace; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="margin-top: 0px; margin-bottom: 0px; font-family: "Consolas", "Courier", monospace; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
I suspect I'll have to go by way of Profiles, and an amrTranslationStrategy, but I'm not clear on the details.</div>
<div style="margin-top: 0px; margin-bottom: 0px; font-family: "Consolas", "Courier", monospace; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="margin-top: 0px; margin-bottom: 0px; font-family: "Consolas", "Courier", monospace; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Thanks!</div>
<div style="margin-top: 0px; margin-bottom: 0px; font-family: "Consolas", "Courier", monospace; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
<br>
</div>
<div style="margin-top: 0px; margin-bottom: 0px; font-family: "Consolas", "Courier", monospace; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Zach</div>
</body>
</html>