Duo integration via OIDC?

[Cantor, Scott]

On 5/12/20, 2:34 PM, "dev on behalf of Wessel, Keith" <dev-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:

> In your May update, you mentioned one of the pieces the project might eventually develop with the new pplugin model
> is Duo integration via OIDC. I think I had previously heard you mention that Duo may phase out the current iframe
> model of UI, as well. Are these related?

Well, the need for the code is related, the plugin angle is a project consideration. The quick and dirty implementation using Duo's OIDC code uses a different OIDC library than the one we used, which makes them a bad fit together, so having both be external modules avoids people not using one of them from having to depend on two different OIDC code bases they aren't even using. Eventually a clean version using our OIDC code should be a replacement we can transition to but it will still be a plugin.

> And does Duo currently support the OIDC model in production? If so, do you have any resources about it?

I don't think it's production, and I doubt they've actually been official about it yet. I'm sure their schedule might be impacted by current events. They shared early access code with us as a courtesy because we have an obvious role to play in them getting people off the old SDK.

> Institutions like mine who have (possibly unwisely) developed their own custom iframe to replace Duo's are quite
> possibly going to encounter some issues at worst or at least be doing things "the old way" at best if Duo makes this
> switch of technology, and I'd like to better understand what it looks like.

Well, you physically can't do it, obviously, proxying means the UI is theirs (subject to customization of some sort I imagine). If they choose to do the obvious and shut down the old API eventually, you will have to give it up. That's obviously between them and their customers that choose to make it a point of contention with them, but having trapped all your tokens in their database, your leverage is, shall we say, compromised.

I believe Azure MFA is also an OIDC proxy integration model, so it's safe to say "that's how this works now". People that don't care for it probably should evaluate something like PrivacyIdea sooner or later I guess. I think it's a good path for us as a project to get wide support for a lot of tech at once, but I found it pretty raw as an actual deployable piece of software. UIs are hard, but we're not going to do any better than PrivacyIdea, so there's not much value in us trying.

-- Scott