Multiple Duo Integrations with distinct principal sets

[Cantor, Scott]

On 1/9/17, 5:36 PM, "users on behalf of Mulchek, Paul" <users-bounces at shibboleth.net on behalf of mulchekp at wustl.edu> wrote:

>    Thanks for clearing up the util list values as we were having similar troubles with it, good timing.

Never take examples at face value.
 
> We are also trying to use Multiple Integrations with distinct principle sets and are running into an issue. We can call duo
> for individual integrations based on authncontextclassRef for the initial mfa calling to Duo. However, when changing
> authncontextclassRef profiles and trying to reuse the mfa result it is never getting to authn to evaluate the profile giving
> an error of NoAuthnContext.

You are likely creating the problem by telling it to run a flow that is not compatible with the request, and that's up to you to prevent. The system will check the result to prevent errors from leaving the system, but it just does what you tell it until then and if you tell it to run Duo and Duo ends up being insufficient or incompatible, then it will fail. Your scripts and transition rules must check for acceptability and prevent impossible outcomes.

-- Scott