- [CAS server version 5.0.2 - Container/environment type/version (Tomcat, Jetty, Java, Linux/Windows, etc) Apache Tomcat/8.5.6 - Steps to duplicate the problem We're using these properties in cas.properties cas.authn.mfa.globalProviderId=mfa-duo cas.authn.mfa.globalPrincipalAttributeNameTriggers=AccountEntitlement cas.authn.mfa.globalPrincipalAttributeValueRegex=/some/entitlement/value
The behavior we're seeing is when these properties are set, mfa-duo is indeed active for all cas logins, but the globalPrincipalAttribute* properties are ignored, or I'm misunderstanding how these properties are supposed to work. We would expect that these attribute properties are checked for when to enable mfa-duo for a given user, but that doesn't seem to be the case. To reproduce, we put in a bogus globalPrincipalAttributeValueRegex and mfa-duo was still active for all logins after a CAS restart -- - CAS gitter chatroom: https://gitter.im/apereo/cas - CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html - CAS documentation website: https://apereo.github.io/cas - CAS project website: https://github.com/apereo/cas --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/0e7dbb48-c21b-4aeb-b7a4-cebe27d9788f%40apereo.org.
