SSO support with DUO MFA

[Maharaj, Sudhir]

Hi,

I am hoping to leverage the input from the your experience, implementation and best practice around SSO with MFA support.

Testing DUO the following use case/ issue was raised:

SP1 - supported with Authn/UserPassword by IDP
SP2 - supported with  Authn/DuoUserPassword by IDP

(1)
- Login to SP1, prompt for credential and access is permitted to resource.
- Login to SP2, no prompt for credential, no prompt for DUO 2nd factor and access is permitted to resource.

(2)
Adjusted SP2 to use forceAuthn="true" and as expected:
- Login to SP1, prompt for credentials and access is permitted to resource.
- Login to SP2, prompt for credential, prompt for DUO 2nd factor and access is permitted to resource.

(2) isn't really SSO per se.

What or rather how are those with live implementations/support for SSO with  MFA handling the above? Are users accustomed to and accepting that MFA support will require re-entry of credentials?

Any feedback or guidance would be much appreciated.

Thanks in advance.
Sudhir