Forcing Duo by Service Provider

[Cantor, Scott]

On 4/5/17, 2:41 PM, "users on behalf of Brandon McKean" <users-bounces at shibboleth.net on behalf of mckeanbs at jmu.edu> wrote:

> I'll be frank and say that I spent hours trying to figure that way out 
> and made no progress. If a detailed step by step for the correct way 
> were published on the wiki or similar, believe me I'd be using that. As 
> it stands I just couldn't make it work.

Pick a context class URI. Associate it with the MFA flow and the Duo flow as a supported Principal. Define a RelyingParty override for all the relevant SPs that require MFA and put that same context class Principal in as the defaultAuthenticationMethod. The profile configuration documentation in the wiki around the defaultAuthenticationMethod setting has a complete example of what to do to make it safe to use.

My MFA "checkSecondFactor" script is this:

                nextFlow = "authn/Duo";

                // Go to second factor if we have to.
                authCtx = input.getSubcontext("net.shibboleth.idp.authn.context.AuthenticationContext");
                mfaCtx = authCtx.getSubcontext("net.shibboleth.idp.authn.context.MultiFactorAuthenticationContext");
                if (mfaCtx.isAcceptable()) {
                    nextFlow = null;
                }

                nextFlow;   // pass control to second factor or end with the first

If you need more than that, you're including user-specific criteria into the decision. There is no reason for any SP-specific rules to be in that script, it's more work that way and less flexible.

-- Scott