Duo cancel event handling. IdPv3.3/SP2.5

[O'Dowd, Josh]

> Well, the SP log of that sort is the transaction log, and it won't log anything like that unless it's configured very differently from the defaults. But that can be done, logging of status codes, etc.

We have the transaction log at default and, you're right, there is nothing there to associate the failure to.  The snippet I shared came from the /var/log/httpd-error.log.  It is a shibd entry:

Jan  4 10:27:59 xxxxxxx httpd: [Wed Jan 04 10:27:59.598524 2017] [mod_shib:error] [pid 40056] [client xx.xx.xx.xx:xxxxx] SAML response reported an IdP error., referer: https://{HOST}/idp/profile/SAML2/Redirect/SSO?execution=e1s2&_eventId=cancel

... it looks like just the browser form post request back to the IdP from the duo.vm.

>Keith Wessel successfully verified that you can trigger a custom event with a script. You'd map a transition out of the Duo step such that ReselectFlow leads to a script step. That step would set the event field in the MultiFactorAuthenticationContext to a custom event ID. You'd add that custom event ID to a couple of places to get it accepted by the system and routed into whatever result you wanted.

Thanks.  I'll give the scripting idea a good look before I bail on it.

Josh