Duo login for shibboleth

[David Langenberg]

On March 24, 2016 at 9:27:03 AM, Cantor, Scott (cantor.2 at osu.edu<mailto:cantor.2 at osu.edu>) wrote:
> Are we discussing "trusted networks" in the Enterprise Edition or the
> advance geo-location features in the Platform Edition?

Trusted networks primarily, as well as time based bypass (the latter moreso really, but in the end it's all of a piece).

> Using trusted networks is a policy decision that states being on that network
> satisfies MFA. Whether this is good or bad policy is up for debate.

I'm not asking people to agree it's bad policy, I'm asking for a third option that allows Duo to work any way it's told to but for the IdP to get enough information to accurately reflect the outcome if I don't happen to think that those are equivalent outcomes. I don't think everybody will agree. As far as I'm able to tell, the tenor of the InCommon discussion has been that it's not equivalent, but that remains to be seen I guess.

When you hand off with a frame like that, you are giving up a great deal of control and it's really important that you don't also give up visibility into the outcome.

I agree it would be nice if the webSDK would tell you how the user "performed" the second factor (push, phone, sms, U2F, token, bypass, trusted device, trusted network) so the application could at least make an informed choice about what to do with the user.  You could, however, flip this request around and setup multiple Duo webSDK integrations with your IdP.  That way you could have a context for "anything duo supports" vs one for "anything except phone, trusted devices, and trusted networks".  You'd then have the information you needed about what the user did (or didn't do) when they performed the additional factor.

Dave
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160324/3be3cf58/attachment.html>