Forcing Duo 2FA at the IdP

[Cantor, Scott]

> Sorry for just getting back to this, but I have been trying to get this to work
> based on the previous response.  However, I am still running into the same
> problem; that is forcing DUO 2FA at the IdP will only work if I have an existing
> session form a previous Shibboleth login.  As Scott pointed out, without the
> existing session, there is no username for Duo to consume.

Then you didn't run the first factor, which means you took the example provided that does what you need and changed it.

The behavior out of the box handles all this for you. Just replace IPAddress/Password with Password/Duo and it all works. The scripts supplied already deal with making sure the Password factor runs first. The Duo flow takes a pluggable function to get the username, and I've covered this (and given people pointers to the exact Java function that it uses), it gets it from:

- the c14n output of the first factor flow (usually Password, but it's up to your rules) OR
- a previous session if the first factor was bypassed for SSO

Those two cases cover the full range of possibilities that I can think of and it's wired in for you, there's literally nothing you have to touch except to make sure that the c14n step out of the Password flow produces the "right" value to give to Duo. That's entirely a local issue, I can't tell you how to do that step. Maybe it's automatic or maybe it's a directory lookup, in which case you need to use the attribute-sourced c14n feature.

> To restate the problem, I need to force Duo 2FA for the SP regardless of
> whether the SP requests that context or not and regardless of if there is
> already an existing session or not (i.e., Duo 2FA is the only authorized login
> context for this SP).

That is what it does out of the box with the supplied MFA example. Any SP that requests a context class corresponding to the Duo flow's supported Principal set (or any SP whose relying party configuration specifies it as a defaultAuthenticationMethod) will trigger Duo at the appropriate times.

> Is this possible?  If you can point me to existing documentation on how to do
> this or if someone can provide an example that would be much appreciated.

That's what 3.3 comes with, it literally *is* the supplied example.

-- Scott