That’s how global works. Remove the setting and it will no longer “globall”y activate MFA.
--Misagh From: [email protected] [mailto:[email protected]] On Behalf Of Dusty Edenfield Sent: Thursday, February 16, 2017 6:27 PM To: CAS Community <[email protected]> Subject: [cas-user] Having trouble configuring mfa.globalPrincipalAttributeNameTriggers · [CAS server version 5.0.2 · Container/environment type/version (Tomcat, Jetty, Java, Linux/Windows, etc) Apache Tomcat/8.5.6 · Steps to duplicate the problem We're using these properties in cas.properties cas.authn.mfa.globalProviderId=mfa-duo cas.authn.mfa.globalPrincipalAttributeNameTriggers=AccountEntitlement cas.authn.mfa.globalPrincipalAttributeValueRegex=/some/entitlement/value The behavior we're seeing is when these properties are set, mfa-duo is indeed active for all cas logins, but the globalPrincipalAttribute* properties are ignored, or I'm misunderstanding how these properties are supposed to work. We would expect that these attribute properties are checked for when to enable mfa-duo for a given user, but that doesn't seem to be the case. To reproduce, we put in a bogus globalPrincipalAttributeValueRegex and mfa-duo was still active for all logins after a CAS restart -- - CAS gitter chatroom: https://gitter.im/apereo/cas - CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html - CAS documentation website: https://apereo.github.io/cas - CAS project website: https://github.com/apereo/cas --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected] <mailto:[email protected]> . To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/0e7dbb48-c21b-4aeb-b7a4-cebe27d9788f%40apereo.org <https://groups.google.com/a/apereo.org/d/msgid/cas-user/0e7dbb48-c21b-4aeb-b7a4-cebe27d9788f%40apereo.org?utm_medium=email&utm_source=footer> . -- - CAS gitter chatroom: https://gitter.im/apereo/cas - CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html - CAS documentation website: https://apereo.github.io/cas - CAS project website: https://github.com/apereo/cas --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/006701d288ef%24e22c6fd0%24a6854f70%24%40unicon.net.
