The goal of the needed Shibb IdP config mentioned below can be simply stated as this:
User clicks federated login link (the link will be provided in the invitation email).
User selects IdP from discovery service
IdP receives SAML authenticationRequest with 'Password', 'PasswordProtectedTransport', 'http://id.incommon.org/assurance/base-level', and 'https://refeds.org/profile/mfa' set as the allowed/requested SAML authenticationContextClassRef values.
IdP optionally asks user if they want to use MFA authentication
SP/app receives SAML assertion with user's ePPN.
SP/app looks up user's invitation and determines if the user is an RAO.
If the user is an RAO, then the SAML authenticationContextClassRef in the received assertion is checked.
If the RAO user did not authenticate with MFA, they are sent back to the IdP with only 'https://refeds.org/profile/mfa' set as the allowed/requested SAML authenticationContextClass (since the user was identified as an RAO). Otherwise, the user is a DRAO and they are logged in.
Comodo Certificate Manager (CCM) SAML SP entityID (present in the InCommon metadata aggregate)
Both eppn and email address are required.
EduPersonPrincipalName [eppn] (SAML: urn:oid:22.214.171.124.4.1.59126.96.36.199.6)
Email address [mail] (SAML: urn:oid:0.9.2342.19200300.100.1.3)
First and last name are optional.
First name [givenName] (SAML: urn:oid:188.8.131.52)
Last name [sn] (SAML: urn:oid:184.108.40.206)
For the initial invitation, the email address asserted by the IdP must match the email address in the invited user’s CCM profile. At that point, the user’s eppn is stored in their CCM profile.
Thereafter, only a match on eppn is required to bind the user to their CCM profile.
The user’s eppn can be edited directly in CCM.
After the initial login, values for email address, first name, and last name received from the IdP will be used to update the related values in the user’s CCM profile
Related IdP Configuration Links
Initial RAO Onboarding (Existing RAOs)
InCommon staff will need to onboard RAOs by sending an invitation email from CCM. Once an institution's IdP is ready, an RAO should send an email to firstname.lastname@example.org and request such onboarding.
RAOs can then onboard their DRAOs using the same invitation function (or by manually entering their eppn in CCM). ← NOTE: Due to a default permissions issue, this will not be functional until 9/13/17.
Onboarding Existing Users
Once logged into CCM, here’s how to onboard existing RAOs/DRAOs in your org:
https://spaces.internet2.edu/pages/viewpage.action?pageId=115180856 (temporarily restricted, awaiting dev fix on 9/13/17)
Change in general-authn.xml: -- Add new 2fa supported principal to both authn/Duo, and authn/MFA -- <bean parent="shibboleth.SAML2AuthnContextClassRef" c:classRef="https://refeds.org/profile/mfa" /> ...and then just add a release rule to attribute-filter.xml: <afp:AttributeFilterPolicy id="Incommon_Certmanager"> <afp:PolicyRequirementRule xsi:type="basic:AttributeRequesterString" value="https://cert-manager.com/shibboleth" /> <afp:AttributeRule attributeID="email"> <afp:PermitValueRule xsi:type="basic:ANY" /> </afp:AttributeRule> <afp:AttributeRule attributeID="givenName"> <afp:PermitValueRule xsi:type="basic:ANY" /> </afp:AttributeRule> <afp:AttributeRule attributeID="surname"> <afp:PermitValueRule xsi:type="basic:ANY" /> </afp:AttributeRule> <afp:AttributeRule attributeID="eduPersonPrincipalName"> <afp:PermitValueRule xsi:type="basic:ANY" /> </afp:AttributeRule> </afp:AttributeFilterPolicy>