forceAuthn & Duo

[Hong Ye]

Hello,

We have configured DUO in IDP 3 using the instruction in wiki
https://wiki.shibboleth.net/confluence/pages/viewpage.action?pageId=20807829

Everything works fine except force authentication. When SP requested forceAuthn=true, user was only prompted for DUO login, not password login. If I disabled DUO in IDP, then password login was prompted. According to the configuration in wiki, when foceAuth is requested 2 minutes after IDP session, authn/Password flow should be used. But I didn’t see this happened.

It seems the configuration defined in flows/Duo/duo-authn-flow.xml is not being used. Is there anything I have to define in IDP to make this xml get executed?

 <!-- if the IdP session is < 2 minutes then don't check for forceAuthn.  If it's more than that
    then check for forceAuthn and if forceAuthn is in play make the user do a 2nd Password login.
    This eliminates the problem we had with a user hitting a forceAuthn site as their first SP & then
    having to double-enter their username/password.
    -->
    <decision-state id="checkFirstLogin">
    <if test="(currentTime.getTime() - opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.session.context.SessionContext)).getIdPSession().getCreationInstant()) > 120000"
            then="checkForceAuth"
            else="duo" />
    </decision-state>
    <decision-state id="checkForceAuth">
        <if test="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).isForceAuthn()"
            then="CallPasswordFlow"
            else="duo" />
    </decision-state>
    <subflow-state id="CallPasswordFlow" subflow="authn/Password">
        <input name="calledAsSubflow" value="true"/>
        <transition on="proceed" to="duo"/>
    </subflow-state>

Thanks,

Hong
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160607/197412aa/attachment-0001.html>