Duo login for shibboleth

[Bryan Wooten]

Are we discussing "trusted networks" in the Enterprise Edition or the advance geo-location features in the Platform Edition?

Using trusted networks is a policy decision that states being on that network satisfies MFA. Whether this is good or bad policy is up for debate.

Bryan Wooten
Tel: (801)585-9323
Email: bryan.wooten at utah.edu




-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Thursday, March 24, 2016 9:00 AM
To: David Langenberg; Liam Hoekenga; Shib Users
Subject: RE: Duo login for shibboleth

> And serously flawed, in that the DuoWeb interface lies to the IdP when 
> it relies on geolocation bypass rules on the Duo side, or similar 
> bypass logic.
> 
> I'm curious how it lies?  Is it easily chalked up to NAT causing the 
> machine to look one way to Duo vs the IdP?

No, it's lying by implying that any authentication was done when you invoke the API call. Bypassing authentication is a policy choice, but it's not the same as doing it, and it shouldn't be assumed that the IdP should be asserting a context class that implies it did do it.

I expect that different deployers will come to different conclusions, but I would anticipate that some of those deployers and communities will choose to conclude that you cannot satisfy an MFA context class by skipping the second factor.

If one were to bake in a fixed decision, that decision ought to be in the other direction than it is now, but there's no reason to bake in any decision; just return the same JSON returned by the Auth API now so it's configurable.

-- Scott

--
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net