IDPv3 and Unicon Duo Plugins and RemoteUser Flow and AWS

[Cantor, Scott]

On 10/10/15, 9:07 PM, "users on behalf of Christopher J. Hubing" <users-bounces at shibboleth.net on behalf of cjh at psu.edu> wrote:


>
>I can't seem to get either Duo plugin working with our config. Our IDPs 
>do not do the AuthN, we use Cosign.

Even allowing that I don't think there is a workable Duo option right now because of basic design limitations, I don't know if we will be able to mix a RemoteUser approach with something local. That's a new wrinkle. I'm sure there will be subtleties there.

>I cranked up the logging to DEBUG and I don't see anything related to 
>duo in the logs.

Any scenario involving multiple flows is a mess now, and really can't work well without a custom flow written to drive the logic. Other options involve having one of the two flows call the other. Either way, there's no way to make two of them unaware of each other "just work" together, the IdP only tries to run one at a time and stops as soon as the request is satisfied.

The only option that exists right now to combine flows is the initial-authentication feature, by forcing one of the flows to run first. Usually that's Password, but could be RemoteUser.

Any SP that doesn't say otherwise is never going to cause Duo to be used. Anything else that's run will satisfy the requirements (namely that there are none) and that's all that will ever be tried. Unless the RemoteUser flow returns a failure, nothing else will ever run. That would require specific customPrincipal configuration for Duo and an SP requesting something that would require it to run.

Absent an actual question, all I can do is talk in generalities. The IdP's logic for deciding what to run is documented pretty extensively. You will quickly see that nothing like Duo fits into that model, so making it work is a custom job right now.

-- Scott