Determining if a user has a Duo token

[Cantor, Scott]

On 8/23/16 3:07 PM, Rich Graves wrote:
> No, version 1.0.1 of Unicon's shib-mfa-duo-auth does not do this, but
> you could check out a bleeding edge branch. I have not looked at Scott's
> interim implementation or 3.3.

I did not. I assumed most people just used inline enrollment, making
anything else a niche case.

The MFA support makes scripting something like this fairly easy to do. I
think baking it into the flow itself errs on the side of trying to guess
too much of a complex workflow that will end up being fairly
site-specific. Having example scripts available to do things like this
on the outside in the "glue" layer probably works better for more people.

Basically, I think the Duo flow should just implement Duo (likewise
FIDO, OATH, anything else). If you have additional requirements to
decide when to do it, that belongs on the outside.

-- Scott