IP address range OR second factor for one SP

[Jared Hoffman]

We have Shibboleth IdP 3.3.1 with Duo for our second factor. We require duo
for all SPs and are able to configure individual SPs to not require duo.

We have been discussing a new case for us. We are wondering if an
individual SP integration (not incommon) could require Duo only if the
requesting user IP is off campus (outside our IP range).

Logically, we are looking for this type of authentication flow:

Username/Password AND (IP address in range OR Duo)

Is it possible to have an either/or authentication flow?


I realize duo can exempt IP addresses, but we don't want to exempt the
entire shibboleth duo integration, only a single SP if you are on campus.

Thanks.

Jared


-- 
Jared Hoffman • Associate Director for Enterprise Infrastructure
Kenyon College LBIS • hoffmanj at kenyon.edu • 740.427.5948
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20170719/d63809d9/attachment.html>