IDP 3 Duo + Username/Password with user-opt-in forcing Duo

[Cantor, Scott]

On 10/12/15, 2:30 PM, "users on behalf of Llosa, Tulio C" <users-bounces at shibboleth.net on behalf of tllos1 at uis.edu> wrote:

>However, the Potential authentication flows left after filtering only retain authn/Password and NOT authn/Duo:

Assuming a flow was enabled generally, it would have to have been filtered out by other criteria, possibly including the SP requesting something specific that the flow doesn't support. Requesting a password-based AuthnContextClassRef usually.

>Where should I be looking to figure out why authn/Duo is not being considered a potential authentication flow? Is it in the global.xml bean definition or in the context-check-intercept-config.xml, or elsewhere?

The context-check feature has nothing at all to do with this kind of scenario. If you're using that, stop, it isn't used for controlling authentication behavior and having to use it for that would be a red flag that there are other problems with the approach.

There is nothing in global.xml at all by default, it's for user-defined Java beans that don't fit anywhere else.

Defining authentication methods includes steps like adding a flow descriptor bean definition to the list in authn/general-authn.xml and then enabling it in the idp.authn.flows property, if you want it on globally speaking. It can also be enabled only at the relying-party level if needed.

Other than SP request content or profile-specific settings, there's nothing else that would filter out any flows from being available if they're on to start with.

-- Scott