Duo cancel event handling. IdPv3.3/SP2.5

[Cantor, Scott]

On 1/4/17, 4:50 PM, "users on behalf of O'Dowd, Josh" <users-bounces at shibboleth.net on behalf of Josh.O'Dowd at mso.umt.edu> wrote:

> No, I was just showing you the only log entry from the SP that indicated why the failure occurred in the first place.

Well, the SP log of that sort is the transaction log, and it won't log anything like that unless it's configured very differently from the defaults. But that can be done, logging of status codes, etc.

> I am just saying that, out of the box, the cancel option on the duo.vm eventually shows the user:

Yes, that's what I'd expect. You have, spec requirements notwithstanding, full control over what actually gets sent back there if you need it. It's just that most of the time nothing on that end will handle anything you send, so it serves little purpose.

> I am not entirely sure how I would use MFA to script a "NoPotentialFlow" event coming out of a system/flows/authn/*-
> flow but it seems like it would have to be overkill for our situation.

Keith Wessel successfully verified that you can trigger a custom event with a script. You'd map a transition out of the Duo step such that ReselectFlow leads to a script step. That step would set the event field in the MultiFactorAuthenticationContext to a custom event ID. You'd add that custom event ID to a couple of places to get it accepted by the system and routed into whatever result you wanted.

Whether that's overkill really depends on what you need. It isn't as trivial as I'd like, but given the constraints of both Spring WebFlow and how we used it, it's a decent feat of engineering to pull off the option to do it with no real coding, so it's good enough for the moment. It sounds like a lot but given an example, it's pretty simple.

-- Scott