MFA result reuse with Duo.

[Cantor, Scott]

On 1/18/17, 2:11 PM, "users on behalf of O'Dowd, Josh" <users-bounces at shibboleth.net on behalf of Josh.O'Dowd at mso.umt.edu> wrote:

> We are running all authn through MFA where authn/Password is the initial flow.  We then have transition scripting to
> determine if the relying party activates a Duo requirement.  In the scenario where there is a prior session where the Duo
> factor was NOT activated, and the user is now trying to access a service that should activate the Duo factor, the MFA
> reuse result is allowing that requirement to be ignored.

If you're doing anything in your script explicitly to force use of Duo, that isn't right. You drive this by supplying requirements via the SAML request or when need be by specifying this in the defaultAuthenticationMethods property of a relying party override (which I would advise triggering with metadata via an EntityAttribute).

If you do that, your script needs to do nothing but evaluate acceptability of the results for the request at each stage, and it will prevent reuse when the MFA result doesn't contain the right principals. That's what the default example shows (with IPAddress and Password, but it's the same).

-- Scott