MCB with Duo and password as fallback

[Wessel, Keith]

Just to confirm, Paul. You said:

If the SP sends both password and Duo, then while one may be preferred by the order given, it still means both are acceptable.

Does that mean that if one, say password, is already met, Duo won't be attempted?

Keith


From: users-bounces at shibboleth.net [mailto:users-bounces at shibboleth.net] On Behalf Of Paul Hethmon
Sent: Wednesday, August 20, 2014 7:16 PM
To: Shibboleth Users
Subject: Re: MCB with Duo and password as fallback

On Aug 20, 2014, at 6:14 PM, Wessel, Keith <kwessel at illinois.edu<mailto:kwessel at illinois.edu>> wrote:


Unfortunately, 1.1.4 doesn't seem to act any differently for me. Same result going straight to the SP configured to ask for both, and same behavior going to the other SP configured for nothing specific first then the specially configured SP. It's never asking for Duo.


Keith,

How do you have your MCB config setup? It sounds like both password and duo end up being equal. I'm thinking you will need something like this:

<context name="password" method="password">
<allowedContexts>duo</allowedContexts>
</context>

<context name="duo" method="duo" />

So Duo is allowed to be used for password, but password is not allowed for Duo. Then, if you are wanting to force Duo, have the SP send only Duo. If the SP sends both password and Duo, then while one may be preferred by the order given, it still means both are acceptable.

Where the greater control comes in is to limit the user to only Duo. So you can say this user is only allowed Duo while the SP can allow either choice.

Paul


Paul Hethmon
Chief Software Architect
paul.hethmon at clareitysecurity.com<mailto:paul.hethmon at clareitysecurity.com>

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140821/887b7bac/attachment.html