Using Duo for per-SP-opt-in

[Jorj Bauer]

>> I'm looking at the Shib2 "Duo 2FA On Demand" article:
>>
>> 	https://wiki.shibboleth.net/confluence/x/ZACt
>>
>> ... and trying to translate that to Shib3 (which I confess is still
>> mostly a dark art to me). Has anyone built an IdPv3 config that
>> implements per-SP opt-in by requesting an alternate transport name?
>
> Transport name? You mean with an AuthnContextClassRef?

Probably. I'm still struggling with the terminology.

> The V3 mechanism is to attach what it calls "custom principal" objects to the specific login flows to tell it which ones the flow supports/satisfies. There's a class used via a built-in parent bean for expressing supported AuthnContextClassRef values. The documentation discusses this and the defalts include examples for password and IP address use.
>
> Duo is very complex because it relies on additional login flows to work, and the IdP doesn't support composite methods, so this gets much more confusing than a more simple scenario like X.509 or SPNEGO, but the basic mechanics are the same, you have to tell it the Duo flow descriptor supports the AuthnContextClassRef.

Thanks. I'll dive in to some more code to understand all that.

> There is no standard ClassRef for Duo. Using one that specifically refers to Duo is also a bad idea. What's needed are community-standard values indicating "password" and "more than password", or some kind of gradation of strength. Otherwise you're basically making it up, so as long as you don't need interoperability, that's perhaps ok.

Yes, I get this (and strongly agree). I'll take what I can get now 
(local definitions), and help steer toward better community standards as 
much as possible.

I did notice some other ... AuthnContextClass identifiers? ... that make 
me wonder what the use cases were for these and how poorly they line up. 
I need to go read more on the subject.

   urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorUnregistered
   urn:oasis:names:tc:SAML:2.0:ac:classes:MobileTwoFactorContract

-- Jorj