MCB with Duo and password as fallback

[Michael A Grady]

On Aug 21, 2014, at 8:37 AM, David Langenberg <davel at uchicago.edu> wrote:

> 
> 
> 
> On Thu, Aug 21, 2014 at 6:35 AM, Tom Scavo <trscavo at gmail.com> wrote:
> On Wed, Aug 20, 2014 at 10:10 PM, Wessel, Keith <kwessel at illinois.edu> wrote:
> > Where my situation gets tricky is that Duo can't be an initial authentication context. The Duo submodule uses a principal from another submodule. In my case, the only context that can be triggered initially, regardless of what was requested, is password.
> 
> I don't know what Duo module you're referring to (one distributed with
> the MCB?) but essentially you're saying the module doesn't support
> step-up authentication.
> 
> He's referring to the MCB Duo module.  The module requires that the user's identity be previously established by another unspecified method before it can be called.
> 
> Dave
> 

Wouldn't think it is the MCB Duo module's "fault", because either it gets invoked or not. It comes down to whether the MCB can currently support the full complexity of use cases some deployers are trying.

If the user had already done password, and the service requesting indicated it only accepted Duo, it will require the user to do Duo. The reported problem seems to come in when the user has already done password as the initial context, and the service will accept either, with Duo listed first. The user is not getting presented the choice to do/"add" Duo.

Does playing games with the two different password contexts, :Password versus :PasswordProtectedContext, make any difference? Listing :Password for initial context, and then having :PasswordProtectedContext as a later context with the same method, and having the service list :PasswordProtectedContext as the 2nd choice? Probably won't make a difference, since both are satisfied by the same method.

--
Michael A. Grady
Senior IAM Consultant, Unicon, Inc.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://shibboleth.net/pipermail/users/attachments/20140821/6cecf4e7/attachment.html