MFA result reuse with Duo.

[Cantor, Scott]

On 1/18/17, 4:16 PM, "users on behalf of Jim Fox" <users-bounces at shibboleth.net on behalf of fox at washington.edu> wrote:

>  We have something related at UW.  We have an SP that requests Password 
>  authn, but for certain users (identified by group membership) they want us 
>   to require Duo as well.  I have no control over this requirement.

Definitely not claiming the requirement is unusual, and I thought of it, I just didn't combine it in my brain with the SP case at the same time. I solved them separately but not together.
    
>  My solution was to replicate MFA, into 'wdmfa' (that's easier than you'd 
>  think) and assign 'wdmfa' to that SP.  Essentially they get their own 
>  'Password'.

I can see that, and no, copying a flow isn't really that hard, it's just the usual warning about copying internals that creates the problem.

I think there might be another way though. There's an obscure setting that addresses an issue with the IdP processing lists of requested AuthnContext classes and whether it does SSO even if a higher priority class in the list doesn't get handled. For example, if you request MFA or Password, and there's an active result for Password, it can be configured to still run the MFA method before reusing Password. It's idp.authn.favorSSO or something like that.

I think it might solve Josh's issue though, since the trick is to get the MFA flow to run if the previous result only meets the lower priority requirement.

Ironically I was just annoying Eric Goodman by noting the IdP doesn't strictly enforce the priority order, but it does process things in order and sometimes you can exploit that.

-- Scott