Determining if a user has a Duo token

[Jonathan Johnson]

You can see how the Unicon service does this at [1], but as stated, this isn’t tied into the default flow, though it’s not too difficult to add it in and do something with.

[1]: [https://github.com/Unicon/shib-mfa-duo-auth/blob/master/src/main/groovy/net/unicon/iam/shibboleth/idp/authn/duo/authn/DuoAuthenticationService.groovy#L55-L72]

-Jj

On August 23, 2016 at 14:07:19, Rich Graves (rgraves at carleton.edu) wrote:

Not entirely sure what you're asking, so a variety of answers to a variety of questions:

Yes, if you're using Duo's Java API you can do a preauth check, see 
https://github.com/duosecurity/duo_shibboleth/blob/master/v3/DuoShibboleth/src/main/java/com/duosecurity/integrations/DuoShibboleth.java

Yes, the low-level /preauth REST API call is documented at https://duo.com/docs/authapi#/preauth and it does *not* require admin API privilege.

No, version 1.0.1 of Unicon's shib-mfa-duo-auth does not do this, but you could check out a bleeding edge branch. I have not looked at Scott's interim implementation or 3.3.
--  
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160823/c628630a/attachment-0001.html>