MFA result reuse with Duo.

[Cantor, Scott]

On 1/18/17, 4:30 PM, "users on behalf of O'Dowd, Josh" <users-bounces at shibboleth.net on behalf of Josh.O'Dowd at mso.umt.edu> wrote:

> FWIW, when I realized there was going to be a problem with "reuse result checking", my first thought was to check the
> wiki for something telling me that MFA would essentially run again, reuse results in hand, and within MFA reuse would also
> happen recursively.

It arguably should, but I eventually decided that given the overhead of unwrapping all the sub-results and setting up the MFA execution, I should leave it to run the same as always and just check the composite result for acceptability/reuse.

> At the time, though as you already pointed out, I am "triggering" Duo via MFA script, which is not right.

It isn't that it's wrong to trigger it, just that it's better to do it in abstract, technology neutral terms by determing whether the request is satisfied or not. But when you have to factor in user or context requirements it's unavoidable to some extent to trigger it manually. I didn't originally know that's what you were trying to handle.

-- Scott