non-browser Duo authentication

[Kim, Allan]

We did a proof of concept for Duo with ECP based on duo_shibboleth. (Note we've also done proofs of concept for faster-than-light travel and fat-free bacon.) Nothing fancy -- we just inserted an extra state that calls the IFRAME version for browser logins, and the Duo Auth API for non-browser logins:

    <action-state id="DuoTwoFactorPreauth">
        <evaluate expression="duo.performPreauth(environment.getProperty('duo.failmode', 'safe'))"/>
        <transition on="allow" to="proceed" />
        <transition on="auth" to="DuoTwoFactorAuth" />
    </action-state>

        <action-state id="DuoTwoFactorAuth">
        <evaluate expression="!opensamlProfileRequestContext.isBrowserProfile()" />
        <transition on="yes" to="DuoTwoFactorHeadless" />
        <transition on="no" to="DuoTwoFactorIFrame" />
        </action-state>



-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of John C. Pfeifer
Sent: Tuesday, August 01, 2017 1:44 PM
To: Shib Users <users at shibboleth.net>
Subject: non-browser Duo authentication

I’ve just upgraded to Shib IdP 3.3.1 and ditched our external CAS server so I’m now using the authentication flows in Shib including the one for Duo…all is working fine.

I have a use case for a Duo “auto” authentication without a browser interaction presumably using Duo’s AuthAPI.  Before I go off reinventing the wheel, has anyone else already been down this path?

//
John Pfeifer
Division of Information Technology
University of Maryland, College Park

-- 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net