Duo login for shibboleth

[Cantor, Scott]

> And serously flawed, in that the DuoWeb interface lies to the IdP
> when it relies on geolocation bypass rules on the Duo side, or similar bypass
> logic.
> 
> I'm curious how it lies?  Is it easily chalked up to NAT causing the machine to
> look one way to Duo vs the IdP?

No, it's lying by implying that any authentication was done when you invoke the API call. Bypassing authentication is a policy choice, but it's not the same as doing it, and it shouldn't be assumed that the IdP should be asserting a context class that implies it did do it.

I expect that different deployers will come to different conclusions, but I would anticipate that some of those deployers and communities will choose to conclude that you cannot satisfy an MFA context class by skipping the second factor.

If one were to bake in a fixed decision, that decision ought to be in the other direction than it is now, but there's no reason to bake in any decision; just return the same JSON returned by the Auth API now so it's configurable.

-- Scott