IDP 3 Duo + Username/Password with user-opt-in forcing Duo

[Cantor, Scott]

On 10/12/15, 3:04 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:

>Chiming in here since I've been trying to help Tulio get DaveL's replicated MCB functionality working.
>
>In this case, for reasons I don't' fully grasp, the authn/Duo bean is defined in global.xml. Perhaps it should be in general-authn.xml, but Dave suggested to add it to global.xml.

You can define it anywhere, but the bean has to be in the flow descriptor list. There's no point in defining it in global.xml, it's just confusing that way.

>My understanding is that the presence of the ben in globalxml defined as DaveL documents, but replacing the UChicago context with the locally appropriate one, will associate the context with the method. Does this also handle the filtering of contexts based on the assurance (or eduPersonAssurance, whatever you choose to call it) attribute values? That seems to be what's falling down for Tulio... either that or it's not recognizing his bean in global.xml.

Defining the bean doesn't make a login flow active. It has to be in the flow list bean as a candidate flow, and only the setting in idp.properties or a profile setting actually makes it "live". That's so we can ship configuration for lots of flows but not have them effect anything unless they're turned on.

The logs will tell you up front in an early stage exactly what the "potential" flow list is. If Duo's not in that set, it's not on at all.

-- Scott