<html><head><style>body{font-family:Helvetica,Arial;font-size:13px}</style></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">Been working on getting Duo security integrated into a v3 build, and have been pretty successful. Have also been looking a bit at how the flows work to try to fill some of the gaps for the MCB and possibly some further use cases.</div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;"><br></div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">So, the implementation so far:</div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;"><br></div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">In my `idp.properties` file, I’ve set `idp.authn.flows=Password|Duo`, `idp.authn.flows.initial=Password`, `idp.uathn.resolveAttribute=eduPersonAssurance`, and various Duo specific properties. `eduPersonAssurance` is a generated value from a java class that I have out there (the implementation that I am working on for it is calling a web service with principal name, ip address, and SP entityId to get back a list of step-up requirements, if any). Everything works, as expected (at least from my understanding of the default flows).</div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;"><br></div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">My notes:</div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;"><br></div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">1. Canonicalization happens after each authentication. This was unexpected at first until I realized that the both `authn` and `authn-initial` are calling it.</div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">2. For a similar reason, subjects are getting stored to the session (in my case the cookie) after each authentication</div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">3. Only the second authen context is being reported back to the SP. Not such a big deal right now, but something I will have to come back to later.</div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;"><br></div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">Given these, would it be better, then, to just write a single auth handler that has a tighter loop and handles these step ups? I can sort of mitigate what’s going on right now with just the one step up, but if I get to where I need another (say, adding a biometric to the mix), I might need a little bit more than is available currently.</div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;"><br></div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">On a side note, what are your feelings about adding something like the following to `web.xml` in the distribution:</div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;"><br></div><div id="bloop_customfont" style="margin: 0px;"><span style="color: rgb(0, 0, 0); font-family: Helvetica, Arial; font-size: 13px;">```</span></div><div id="bloop_customfont" style="margin: 0px;"><span style="color: rgb(0, 0, 0); font-family: Helvetica, Arial; font-size: 13px;">...</span></div><div id="bloop_customfont" style="margin: 0px;"> <context-param></div><div id="bloop_customfont" style="margin: 0px;"> <param-name>contextConfigLocation</param-name></div><div id="bloop_customfont" style="margin: 0px;"> <param-value></div><div id="bloop_customfont" style="margin: 0px;"> ${idp.home}/system/conf/global-system.xml</div><div id="bloop_customfont" style="margin: 0px;"> classpath*:/META-INF/shib/conf/global.xml</div><div id="bloop_customfont" style="margin: 0px;"> </param-value></div><div id="bloop_customfont" style="margin: 0px;"> </context-param></div><div id="bloop_customfont" style="margin: 0px;">...</div><div id="bloop_customfont" style="margin: 0px;"> <servlet></div><div id="bloop_customfont" style="margin: 0px;"> <servlet-name>idp</servlet-name></div><div id="bloop_customfont" style="margin: 0px;"> <servlet-class>org.springframework.web.servlet.DispatcherServlet</servlet-class></div><div id="bloop_customfont" style="margin: 0px;"> <init-param></div><div id="bloop_customfont" style="margin: 0px;"> <param-name>contextConfigLocation</param-name></div><div id="bloop_customfont" style="margin: 0px;"> <param-value>${idp.home}/system/conf/mvc-beans.xml ${idp.home}/system/conf/webflow-config.xml classpath*:/META-INF/shib/conf/webflow-config.xml</param-value></div><div id="bloop_customfont" style="margin: 0px;"> </init-param></div><div id="bloop_customfont" style="margin: 0px;"> <init-param></div><div id="bloop_customfont" style="margin: 0px;"> <param-name>contextClass</param-name></div><div id="bloop_customfont" style="margin: 0px;"> <param-value>net.shibboleth.ext.spring.context.DeferPlaceholderFileSystemXmlWebApplicationContext</param-value></div><div id="bloop_customfont" style="margin: 0px;"> </init-param></div><div id="bloop_customfont" style="margin: 0px;"> <load-on-startup>1</load-on-startup></div><div id="bloop_customfont" style="margin: 0px;"> </servlet></div><div id="bloop_customfont" style="margin: 0px;">...</div><div id="bloop_customfont" style="margin: 0px;">```</div><div id="bloop_customfont" style="margin: 0px;"><br></div><div id="bloop_customfont" style="margin: 0px;">Allowing spring to pull from the classpath has allowed me to have a drop in jar that contains all the configuration needed for the authentication handler and flows without having a lot of other configuration to do in the system itself.</div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;"><br></div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">It was suggested that I might join the dev call some week to go over some of this with you all, perhaps to go over some of this.</div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;"><br></div><div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">Hope this wall of text doesn’t make anyone too bored :) Thanks</div><br><div class="bloop_sign" id="bloop_sign_1430331089851314944"><div style="font-family:helvetica,arial;font-size:13px">-Jj</div></div></body></html>