No prompt for stronger authentication if initial context "good enough" for first SP #19
Comments
|
Fixed in version 1.2.3 version of mcb. |
|
New version uploaded to fix bug when no context is requested. Still version 1.2.3 but dated 26 March 2015 |
|
Reported by Keith Wessel on 3/31/2015... -------- Forwarded Message -------- Paul, So close! When my user is allowed both password and duo and the service requests both, whether it's the first service I log into or the second, the IDP works perfectly. With showSatisfied set to true, I have a chance to proceed with password or upgrade to Duo when the service requests both. With it set to false, it forces me to upgrade. This latter behavior is exactly what we want. Where I run into problems is when I take away the user's duo privileges. I remove the duo context from the user's IDM assurance attribute but leave both Duo and Password requested from the SP. I'm getting an error from the IDP that it can't satisfy any of the requested contexts even though password is allowed for this user. I'll include a log snippet below. If I remove Duo from the requested contexts from the SP, I get in just fine with password. So, I don't think this is a misconfiguration. I haven't ruled that out, but I suspect a small bug. Detailed logs are below. Thoughts? Keith 16:30:03.603 - INFO [Shibboleth-Access:73] [session=] - 20150331T213003Z|130.126.153.244|shib-test-idp.cites.illinois.edu:443|/profile/SAML2/Redirect/SSO| 16:30:11.971 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBAttributeResolver:78] [session=] - Attribute key = [homeOrganizationType] 16:30:11.971 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBAttributeResolver:78] [session=] - Attribute key = [eduPersonAffiliation] 16:30:11.972 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBAttributeResolver:78] [session=] - Attribute key = [eduPersonPrincipalName] 16:30:11.972 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBAttributeResolver:78] [session=] - Attribute key = [eduPersonPrimaryAffiliation] 16:30:11.973 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBAttributeResolver:78] [session=] - Attribute key = [assurance] 16:30:11.974 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBAttributeResolver:78] [session=] - Attribute key = [gIllinoisID] 16:30:11.979 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBAttributeResolver:78] [session=] - Attribute key = [uiucEduNetID] 16:30:11.979 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBAttributeResolver:78] [session=] - Attribute key = [gIllinoisIDTemplate] 16:30:11.980 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBAttributeResolver:78] [session=] - Attribute key = [organizationName] 16:30:11.981 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBAttributeResolver:78] [session=] - Attribute key = [uiucEduADGroups] 16:30:11.981 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBAttributeResolver:78] [session=] - Attribute key = [eduPersonScopedAffiliation] 16:30:11.982 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBAttributeResolver:78] [session=] - Attribute key = [givenName] 16:30:11.983 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBAttributeResolver:78] [session=] - Attribute key = [eduPersonNickname] 16:30:11.983 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBAttributeResolver:78] [session=] - Attribute key = [googleAppsID] 16:30:11.984 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBAttributeResolver:78] [session=] - Attribute key = [title] 16:30:11.989 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBAttributeResolver:78] [session=] - Attribute key = [uiucEduHomeDeptName] 16:30:11.990 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBAttributeResolver:78] [session=] - Attribute key = [uiucEduSource] 16:30:11.990 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBAttributeResolver:78] [session=] - Attribute key = [eduPersonOrgDN] 16:30:11.991 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBAttributeResolver:78] [session=] - Attribute key = [principal] 16:30:11.992 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBAttributeResolver:78] [session=] - Attribute key = [gTestIllinoisIDTemplate] 16:30:11.992 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBAttributeResolver:78] [session=] - Attribute key = [googleAppsIDTemplate] 16:30:11.993 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBAttributeResolver:78] [session=] - Attribute key = [sAMAccountName] 16:30:11.994 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBAttributeResolver:78] [session=] - Attribute key = [uiucEduMiddleName] 16:30:12.001 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBAttributeResolver:78] [session=] - Attribute key = [eduPersonEntitlement] 16:30:12.001 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBAttributeResolver:78] [session=] - Attribute key = [organizationalUnit] 16:30:12.002 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBAttributeResolver:78] [session=] - Attribute key = [mail] 16:30:12.002 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBAttributeResolver:78] [session=] - Attribute key = [sn] 16:30:12.003 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBAttributeResolver:78] [session=] - Attribute key = [gTestIllinoisID] 16:30:12.004 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBAttributeResolver:78] [session=] - Attribute key = [transientId] 16:30:12.004 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBAttributeResolver:78] [session=] - Attribute key = [uiucEduLastName] 16:30:12.005 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBAttributeResolver:78] [session=] - Attribute key = [iTrustMiddleName] 16:30:12.006 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBAttributeResolver:78] [session=] - Attribute key = [uiucEduFirstName] 16:30:12.015 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBAttributeResolver:78] [session=] - Attribute key = [eduPersonTargetedID] 16:30:12.015 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBAttributeResolver:78] [session=] - Attribute key = [isMemberOf] 16:30:12.016 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBAttributeResolver:78] [session=] - Attribute key = [uiucEduType] 16:30:12.017 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBAttributeResolver:78] [session=] - Attribute key = [telephoneNumber] 16:30:12.017 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBAttributeResolver:78] [session=] - Attribute key = [postalAddress] 1128 Dcl 1304 W Springfield M/C 256 Urbana, IL 61801 16:30:12.018 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBAttributeResolver:78] [session=] - Attribute key = [regex_principal_split] 16:30:12.018 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBAttributeResolver:78] [session=] - Attribute key = [iTrustAffiliation] 16:30:12.025 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBAttributeResolver:78] [session=] - Attribute key = [iTrustUIN] 16:30:12.025 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBAttributeResolver:78] [session=] - Attribute key = [uiucEduUIN] 16:30:12.026 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBAttributeResolver:78] [session=] - Attribute key = [displayName] 16:30:12.027 - DEBUG [edu.internet2.middleware.assurance.mcb.authn.provider.MCBLoginServlet:261] [session=] - Found idms attribute: assurance |
Per issue #19, allow a user who cannot satisfy one context requested by an SP to use one the SP has also requested and that they can satisfy.
|
Build 1.2.5 has been put into github to fix this issue. I am not positive I am handling all of the cases correctly that are possible. The code has gotten to the point where it likely needs to be rewritten to satisfy all the possibilities instead of the tweaks that have been done so far. But maybe it will work for everything. |
Subject: Re: [shib-assure] 1.2.2 testing -- good news and, possibly bad news?
Date: Fri, 13 Feb 2015 08:37:04 -0800
From: David Walker [email protected]
To: [email protected]
Keith,
Chiming in... I also remember discussion of this issue. I think the general principle is that the configured initial authentication context should be handled separate from the incoming request from the SP, making behavior for the first SP and the second SP the same (the second SP exhibiting the correct behavior here). I looked at our Github issue list, and I don't see this one there, however, so I'll add it.
...
David
On 02/12/2015 10:26 AM, Wessel, Keith wrote:
...
However, and I don’t know if this has been tackled yet, we still have the problem with the initial context being “good enough” and the MCB stopping there. To reiterate this issue:
Configure the IDP to have Password and Duo. Configure password as the only initial context since one can’t Duo auth until we know their principal.
With no session, go to an SP that accepts DUO then Password, in that order.
MCB prompts for password, user successfully authenticates.
Rather than giving the option of stepping up to Duo or even requiring it, user gets sent back to SP with Password.
If the SP described above is the 2nd SP the user visits in the session and the user already has satisfied Password from their 1st SP authentication, the MCB will allow for stepping up to Duo or possibly require it depending on configuration. It’s a different user experience, and it provides for functionality (stepping up) different than the 1st scenario above.
I recall agreeing that the scenario should be the same whether the session already existed or was newly created. It’s possible this was already fixed and I’m missing a configuration item. Can someone chime in here and help me out?
Keith
The text was updated successfully, but these errors were encountered: