MCB with Duo and password as fallback

[Wessel, Keith]

To make matters more complicated, the MCB doesn't even attempt X if both X and Y are requested but only Y is configured as an _initial_ context. Since Duo requires that password first be completed, then password is configured as initial. The MCB does that then sees it has a completed method that satisfies a context, even if I'm eligible for the higher context and it was preferred by the SP.

Sadly, I tried with 1.2.0, and same result... Which, based on Paul's explanation, means it's doing what it's designed to do.

Ideally, like Scott said, my SP could request multiple methods in priority order and the IDP would give the user the chance to use the highest one that they're eligible to use even if they're already authenticated at a lower level.

My earlier hack might work -- the 3rd context that also uses the password method. I'm still exploring for other options.

Keith

-----Original Message-----
From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Wednesday, August 20, 2014 8:22 PM
To: Shib Users
Subject: Re: MCB with Duo and password as fallback

On 8/20/14, 9:13 PM, "Paul Hethmon" <paul.hethmon at clareitysecurity.com>
wrote:
>
>A given method can be specified to satisfy multiple context values 
>which ends up rendering them the same in practice. That is because when 
>a user authenticates successfully, they have completed a method. Then 
>any context which uses that method can be satisfied.

Yes, but my point is that SAML requires that the IdP try and honor the requested contexts in the order they're listed. It doesn't qualify that requirement with "unless a later one can be met without actually prompting". It's not irrational to take that view, because users are obviously happier, but it's not actually something the standard would justify, and SPs routinely get confused when this happens, so it's clearly not what they want.

In other words, the strict approach is to say, if the SP requests X, and if X is possible to attempt, you attempt X, even if the user already completed Y and Y is the second one in the request. Replace X with Duo and Y with password in this case.

With V3, the flow selection can be configured with either interpretation.
But if V2 hadn't done it the other way, I wouldn't have implemented that, because the standard is fairly clear about it.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net