MCB with Duo and password as fallback

[Tom Scavo]

On Wed, Aug 20, 2014 at 9:48 PM, Paul Hethmon
<paul.hethmon at clareitysecurity.com> wrote:
>
> I think I need to understand how the Duo module is implemented in order to
> say how it needs to be configured.

Authentication via the second (mobile) factor is controlled by the
application (or IdP login handler): once the user has been
authenticated with a username/password, a user-specific iframe is
presented (if using the Duo Web SDK) or the user identifier (usually
ePPN) is transmitted to the Duo service (if using the Duo Auth API).
If the application receives a login request and the user already has a
session, the username/password step can be skipped since the user is
already known (ignoring ForceAuthn of course).

Does that help?

Tom