So If we remove the cas.authn.mfa.globalProviderId property then the trigger properties will work to trigger mfa based on the attribute regex?
On Friday, February 17, 2017 at 2:31:49 AM UTC-5, Misagh Moayyed wrote: > > That’s how global works. Remove the setting and it will no longer > “globall”y activate MFA. > > > > --Misagh > > > > *From:* [email protected] <javascript:> [mailto:[email protected] > <javascript:>] *On Behalf Of *Dusty Edenfield > *Sent:* Thursday, February 16, 2017 6:27 PM > *To:* CAS Community <[email protected] <javascript:>> > *Subject:* [cas-user] Having trouble configuring > mfa.globalPrincipalAttributeNameTriggers > > > > · [CAS server version > 5.0.2 > > · Container/environment type/version (Tomcat, Jetty, Java, > Linux/Windows, etc) > Apache Tomcat/8.5.6 > > · Steps to duplicate the problem > We're using these properties in cas.properties > cas.authn.mfa.globalProviderId=mfa-duo > cas.authn.mfa.globalPrincipalAttributeNameTriggers=AccountEntitlement > cas.authn.mfa.globalPrincipalAttributeValueRegex=/some/entitlement/value > > The behavior we're seeing is when these properties are set, mfa-duo is > indeed active for all cas logins, but the globalPrincipalAttribute* > properties are ignored, or I'm misunderstanding how these properties are > supposed to work. We would expect that these attribute properties are > checked for when to enable mfa-duo for a given user, but that doesn't seem > to be the case. > > > > To reproduce, we put in a bogus globalPrincipalAttributeValueRegex and > mfa-duo was still active for all logins after a CAS restart > > > > > > -- > - CAS gitter chatroom: https://gitter.im/apereo/cas > - CAS mailing list guidelines: > https://apereo.github.io/cas/Mailing-Lists.html > - CAS documentation website: https://apereo.github.io/cas > - CAS project website: https://github.com/apereo/cas > --- > You received this message because you are subscribed to the Google Groups > "CAS Community" group. > To unsubscribe from this group and stop receiving emails from it, send an > email to [email protected] <javascript:>. > To view this discussion on the web visit > https://groups.google.com/a/apereo.org/d/msgid/cas-user/0e7dbb48-c21b-4aeb-b7a4-cebe27d9788f%40apereo.org > > <https://groups.google.com/a/apereo.org/d/msgid/cas-user/0e7dbb48-c21b-4aeb-b7a4-cebe27d9788f%40apereo.org?utm_medium=email&utm_source=footer> > . > -- - CAS gitter chatroom: https://gitter.im/apereo/cas - CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html - CAS documentation website: https://apereo.github.io/cas - CAS project website: https://github.com/apereo/cas --- You received this message because you are subscribed to the Google Groups "CAS Community" group. To unsubscribe from this group and stop receiving emails from it, send an email to [email protected]. To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/de38e4cd-6145-4459-9b6b-11098ebf8f42%40apereo.org.
