Hi,
Thanks for reply.
Last week I have tested to migrate to shib-cas-authn3 3.2.4.beta4 without
success because this version doesn't support mfa-gauth completely.
The translation is build here :
https://github.com/Unicon/shib-cas-authn3/blob/master/src/main/java/net/unicon/idp/externalauth/CasDuoSecurityRefedsAuthnMethodTranslator.java
but there is not mention of mfa-gauth.
I have open an issue 8 days ago but I have not answer at this time.
2019-02-25 09:03:46,521 - DEBUG
[net.unicon.idp.externalauth.AuthenticatedNameTranslator:44] -
principalName found and being passed on: XXXXXXXXXX
2019-02-25 09:03:46,522 - DEBUG
[net.unicon.idp.externalauth.AuthenticatedNameTranslator:94] - Added
attribute credentialType with values [UsernamePasswordCredential,
GoogleAuthenticatorTokenCredential]
2019-02-25 09:03:46,522 - DEBUG
[net.unicon.idp.externalauth.AuthenticatedNameTranslator:94] - Added
attribute samlAuthenticationStatementAuthMethod with values
[urn:oasis:names:tc:SAML:1.0:am:password,
urn:oasis:names:tc:SAML:1.0:am:unspecified]
2019-02-25 09:03:46,523 - DEBUG
[net.unicon.idp.externalauth.AuthenticatedNameTranslator:94] - Added
attribute uid with values XXXXXXXXXX
2019-02-25 09:03:46,523 - DEBUG
[net.unicon.idp.externalauth.AuthenticatedNameTranslator:94] - Added
attribute isFromNewLogin with values true
2019-02-25 09:03:46,523 - DEBUG
[net.unicon.idp.externalauth.AuthenticatedNameTranslator:94] - Added
attribute bypassMultifactorAuthentication with values false
2019-02-25 09:03:46,523 - DEBUG
[net.unicon.idp.externalauth.AuthenticatedNameTranslator:94] - Added
attribute authenticationDate with values
2019-02-25T09:03:46.330+01:00[Europe/Paris]
2019-02-25 09:03:46,524 - DEBUG
[net.unicon.idp.externalauth.AuthenticatedNameTranslator:94] - Added
attribute authenticationMethod with values [LdapAuthenticationHandler,
GoogleAuthenticatorAuthenticationHandler]
2019-02-25 09:03:46,524 - DEBUG
[net.unicon.idp.externalauth.AuthenticatedNameTranslator:94] - Added
attribute authnContextClass with values mfa-gauth
2019-02-25 09:03:46,524 - DEBUG
[net.unicon.idp.externalauth.AuthenticatedNameTranslator:94] - Added
attribute successfulAuthenticationHandlers with values
[LdapAuthenticationHandler, GoogleAuthenticatorAuthenticationHandler]
2019-02-25 09:03:46,524 - DEBUG
[net.unicon.idp.externalauth.AuthenticatedNameTranslator:94] - Added
attribute longTermAuthenticationRequestTokenUsed with values false
2019-02-25 09:03:46,525 - DEBUG
[net.unicon.idp.externalauth.AuthenticatedNameTranslator:51] - Found
attributes from CAS. Processing...
2019-02-25 09:03:46,525 - INFO
[net.unicon.idp.externalauth.AuthenticatedNameTranslator:60] - Created an
IdP subject instance with principals containing attributes for XXXXXXXXXX
2019-02-25 09:03:46,526 - DEBUG
[net.unicon.idp.externalauth.CasDuoSecurityRefedsAuthnMethodTranslator:51]
- No requested principal context is available in the authentication
context; Overriding class to
urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
2019-02-25 09:03:46,526 - INFO
[net.unicon.idp.externalauth.CasDuoSecurityRefedsAuthnMethodTranslator:91]
- Overriding the principal authn context class ref to
urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
2019-02-25 09:03:46,527 - DEBUG
[net.shibboleth.idp.authn.principal.PrincipalEvalPredicateFactoryRegistry:106]
- Registering predicate factory of type
'net.unicon.idp.externalauth.CasDuoSecurityRefedsAuthnMethodTranslator$1'
for principal type 'class
net.shibboleth.idp.saml.authn.principal.AuthnContextClassRefPrincipal' and
operator 'exact'
2019-02-25 09:03:46,527 - INFO
[net.unicon.idp.externalauth.CasDuoSecurityRefedsAuthnMethodTranslator:122]
- The final requested authn context class ref principals are
[AuthnContextClassRefPrincipal{authnContextClassRef=urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport}]
Sincerely,
Mickaël
Le vendredi 22 février 2019 22:28:01 UTC+1, Misagh Moayyed a écrit :
>
> shib-cas-authn3 3.2.3 does not support handling authn context classes
> received from CAS. Switch to a more recent version such as a 3.2.4.beta4
> please. The readme also provides an example of how one can map MFA on CAS
> to the REFEDS profile, which might serve as inspiration for you.
>
> On Friday, February 15, 2019 at 9:04:36 AM UTC-7, Mickaël wrote:
>>
>> Hi everybody,
>>
>> I have a Shibboleth IDP v3.4.3 with the plugin shibcas 3.2.3 for
>> delegating authentification to my CAS server in version 5.3.3.
>> On my CAS server, for specific service, users should do an authentication
>> by login/password AND Google OTP.
>>
>> My problem is the next, my CAS return a strange value to my shibcas :
>>
>> 2019-02-15 16:17:54,149 - DEBUG
>> [net.unicon.idp.externalauth.ShibcasAuthServlet:44] - principalName found
>> and being passed on: XXXXXX
>> 2019-02-15 16:17:54,150 - DEBUG
>> [net.unicon.idp.externalauth.ShibcasAuthServlet:94] - Added attribute
>> credentialType with values [UsernamePasswordCredential,
>> GoogleAuthenticatorTokenCredential]
>> 2019-02-15 16:17:54,150 - DEBUG
>> [net.unicon.idp.externalauth.ShibcasAuthServlet:94] - Added attribute
>> samlAuthenticationStatementAuthMethod with values
>> [urn:oasis:names:tc:SAML:1.0:am:password,
>> urn:oasis:names:tc:SAML:1.0:am:unspecified]
>> 2019-02-15 16:17:54,150 - DEBUG
>> [net.unicon.idp.externalauth.ShibcasAuthServlet:94] - Added attribute uid
>> with values XXXXXXX
>> 2019-02-15 16:17:54,151 - DEBUG
>> [net.unicon.idp.externalauth.ShibcasAuthServlet:94] - Added attribute
>> isFromNewLogin with values true
>> 2019-02-15 16:17:54,151 - DEBUG
>> [net.unicon.idp.externalauth.ShibcasAuthServlet:94] - Added attribute
>> bypassMultifactorAuthentication with values false
>> 2019-02-15 16:17:54,151 - DEBUG
>> [net.unicon.idp.externalauth.ShibcasAuthServlet:94] - Added attribute
>> authenticationDate with values 2019-02-15T16:17:53.562+01:00[Europe/Paris]
>> 2019-02-15 16:17:54,152 - DEBUG
>> [net.unicon.idp.externalauth.ShibcasAuthServlet:94] - Added attribute
>> authenticationMethod with values [LdapAuthenticationHandler,
>> GoogleAuthenticatorAuthenticationHandler]
>> 2019-02-15 16:17:54,152 - DEBUG
>> [net.unicon.idp.externalauth.ShibcasAuthServlet:94] - Added attribute
>> authnContextClass with values mfa-gauth
>> 2019-02-15 16:17:54,152 - DEBUG
>> [net.unicon.idp.externalauth.ShibcasAuthServlet:94] - Added attribute
>> successfulAuthenticationHandlers with values [LdapAuthenticationHandler,
>> GoogleAuthenticatorAuthenticationHandler]
>> 2019-02-15 16:17:54,159 - DEBUG
>> [net.unicon.idp.externalauth.ShibcasAuthServlet:94] - Added attribute
>> longTermAuthenticationRequestTokenUsed with values false
>> 2019-02-15 16:17:54,160 - DEBUG
>> [net.unicon.idp.externalauth.ShibcasAuthServlet:51] - Found attributes from
>> CAS. Processing...
>>
>> So my Shibboleth sent to the SP :
>> urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport
>>
>> Is there a missing configuration on my CAS to send the right SAML
>> assertion ?
>>
>> Thanks for response.
>>
>> Sincerely, Mickaël
>>
>
--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/abf45f39-4d06-4657-9311-f0e3f59e811d%40apereo.org.
