Duo MFA with Exernal AuthN as first flow

[Cantor, Scott]

On 11/14/16, 7:02 PM, "users on behalf of Travis Schmidt" <users-bounces at shibboleth.net on behalf of travis.schmidt at gmail.com> wrote:

>    I set a IdP 3.3 server today to try out the MFA with Duo specifically.  When using the Shibcas plugin for the first
> flow, the Duo flow would error with a null pointer exception in DuoWeb.

That would be a bug. Even if there's a constraint somewhere, it should never fail that way.

> I thought maybe the username was causing the problem   so I set it up to use Password as the first flow and then
> Duo authn worked as expected.  Could there be a problem using External AuthN as the first flow, or does Shibcas
> plugin need to be updated to be compatible with changes in IdP 3.3?

There has to be a user identity established to use Duo. The Duo flow doesn't care what flow you use to establish the identity (that's the first factor).

The default behavior for how to obtain that identity can be overridden (it's a function) but doing that without care is an easy way to end up with an insecure system, and there should almost never be a need to do that.

If the first flow fails, your scripting/workflow should be preventing the Duo flow from running, so that shouldn't be the reason for the exception and it certainly isn't how it works by default.

-- Scott