IDP 3 Duo + Username/Password with user-opt-in forcing Duo

[Llosa, Tulio C]

That was it! Moving the bean definition from the global.xml to the general-authn.xml solved the problem I was having below. Thank you for your quick diagnosis! 

I wonder why Keith's works the other way around?

I also cleared  what I had on the context-check-intercept-config.xml file. I am now working on another Duo problem, but at least the IDP sees authn/Duo as a potential authentication flow.  

Again, many thanks for the GREAT explanation and assistance!

Tulio

-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Monday, October 12, 2015 2:38 PM
To: Shib Users
Subject: Re: IDP 3 Duo + Username/Password with user-opt-in forcing Duo

On 10/12/15, 3:04 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:

>Chiming in here since I've been trying to help Tulio get DaveL's replicated MCB functionality working.
>
>In this case, for reasons I don't' fully grasp, the authn/Duo bean is defined in global.xml. Perhaps it should be in general-authn.xml, but Dave suggested to add it to global.xml.

You can define it anywhere, but the bean has to be in the flow descriptor list. There's no point in defining it in global.xml, it's just confusing that way.

>My understanding is that the presence of the ben in globalxml defined as DaveL documents, but replacing the UChicago context with the locally appropriate one, will associate the context with the method. Does this also handle the filtering of contexts based on the assurance (or eduPersonAssurance, whatever you choose to call it) attribute values? That seems to be what's falling down for Tulio... either that or it's not recognizing his bean in global.xml.

Defining the bean doesn't make a login flow active. It has to be in the flow list bean as a candidate flow, and only the setting in idp.properties or a profile setting actually makes it "live". That's so we can ship configuration for lots of flows but not have them effect anything unless they're turned on.

The logs will tell you up front in an early stage exactly what the "potential" flow list is. If Duo's not in that set, it's not on at all.

-- Scott

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net