Using Duo for per-SP-opt-in

[Cantor, Scott]

On 1/27/16, 9:35 AM, "users on behalf of Jorj Bauer" <users-bounces at shibboleth.net on behalf of jorj at temple.edu> wrote:



>I'm looking at the Shib2 "Duo 2FA On Demand" article:
>
>	https://wiki.shibboleth.net/confluence/x/ZACt
>
>... and trying to translate that to Shib3 (which I confess is still 
>mostly a dark art to me). Has anyone built an IdPv3 config that 
>implements per-SP opt-in by requesting an alternate transport name?

Transport name? You mean with an AuthnContextClassRef?

The V3 mechanism is to attach what it calls "custom principal" objects to the specific login flows to tell it which ones the flow supports/satisfies. There's a class used via a built-in parent bean for expressing supported AuthnContextClassRef values. The documentation discusses this and the defalts include examples for password and IP address use.

Duo is very complex because it relies on additional login flows to work, and the IdP doesn't support composite methods, so this gets much more confusing than a more simple scenario like X.509 or SPNEGO, but the basic mechanics are the same, you have to tell it the Duo flow descriptor supports the AuthnContextClassRef.

There is no standard ClassRef for Duo. Using one that specifically refers to Duo is also a bad idea. What's needed are community-standard values indicating "password" and "more than password", or some kind of gradation of strength. Otherwise you're basically making it up, so as long as you don't need interoperability, that's perhaps ok.

-- Scott