[JIRA] (JDUO-62) Flag to disable Duo Health Check

[Philip Smart (Jira)]

Philip Smart ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=5afecdc1eb3ffa0c596652c4 ) *created* an issue

IdP Plugin - Duo ( https://shibboleth.atlassian.net/browse/JDUO?atlOrigin=eyJpIjoiZjg5OWEwOTVjOTI3NGZkZGI3NzMzNWUyYWM5MjBjZTQiLCJwIjoiaiJ9 ) / Improvement ( https://shibboleth.atlassian.net/browse/JDUO-62?atlOrigin=eyJpIjoiZjg5OWEwOTVjOTI3NGZkZGI3NzMzNWUyYWM5MjBjZTQiLCJwIjoiaiJ9 ) JDUO-62 ( https://shibboleth.atlassian.net/browse/JDUO-62?atlOrigin=eyJpIjoiZjg5OWEwOTVjOTI3NGZkZGI3NzMzNWUyYWM5MjBjZTQiLCJwIjoiaiJ9 ) Flag to disable Duo Health Check ( https://shibboleth.atlassian.net/browse/JDUO-62?atlOrigin=eyJpIjoiZjg5OWEwOTVjOTI3NGZkZGI3NzMzNWUyYWM5MjBjZTQiLCJwIjoiaiJ9 )

Issue Type: Improvement Assignee: Philip Smart ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=5afecdc1eb3ffa0c596652c4 ) Created: 09/Nov/22 8:29 AM Fix Versions: 1.3.0 Priority: Trivial Reporter: Philip Smart ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=5afecdc1eb3ffa0c596652c4 )

I made a mistake. The Duo health check endpoint can be bypassed and the authentication proceeds as normal (it seems).

It is still part of their 'Detailed SDK Workflow' [1] , is used by their example client [2] , and is part of their logic to determine if a request should fail 'open' or 'closed' depending on the result of the health check. However, it seems it really is just a 'health check' and is not tied to the authz request — as I used to think (not sure if anything actually changed or not).

In which case it seems pretty pointless to me. The 2FA will fail if the authz request fails e.g. a timeout or error returned, and of course, the health check itself could fail for the same reason. I can not see the value in a background service checking the health of the service once a day, etc.; that is not how they use it either.

I don't have any data points to determine if disabling it could be an issue long-term, but I doubt it would be.

I will add a flag to disable the check idp.duo.oidc.healthcheck.enabled. By default, it is enabled, to avoid any regressions on update, and to comply with their described SDK Workflow.

[1] https://duo.com/docs/duoweb#detailed-sdk-workflow ( https://duo.com/docs/duoweb#detailed-sdk-workflow )
[2] https://github.com/duosecurity/duo_universal_java/blob/main/duo-example/src/main/java/com/duosecurity/controller/LoginController.java ( https://github.com/duosecurity/duo_universal_java/blob/main/duo-example/src/main/java/com/duosecurity/controller/LoginController.java )

( https://shibboleth.atlassian.net/browse/JDUO-62#add-comment?atlOrigin=eyJpIjoiZjg5OWEwOTVjOTI3NGZkZGI3NzMzNWUyYWM5MjBjZTQiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/JDUO-62#add-comment?atlOrigin=eyJpIjoiZjg5OWEwOTVjOTI3NGZkZGI3NzMzNWUyYWM5MjBjZTQiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100210- sha1:1025071 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20221109/263a320f/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-46b7d305-e34a-4728-a743-cda6876aad1d
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221109/263a320f/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-335da135-f608-489c-b445-eb592f77db56
Type: image/png
Size: 457 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221109/263a320f/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-trivial-c8b60589-ced9-4fec-973d-09a748d1a65b
Type: image/png
Size: 563 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221109/263a320f/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-b9cf7eb1-c725-458a-a79d-9fe940cbf5a9
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20221109/263a320f/attachment-0007.png>