IP address range OR second factor for one SP

[Cantor, Scott]

> Logically, we are looking for this type of authentication flow:
> 
> Username/Password AND (IP address in range OR Duo)
> 
> Is it possible to have an either/or authentication flow?

There are probably a couple of different ways, scripting is a given. If your rules are based on SP and you have a really simple MFA config (like mine is), then you might want to avoid polluting that part with more complexity.

All your settings for which SPs require Duo would be via relying-party.xml directly or indirectly, so via the feature added to 3.3, you would have the ability to plugin a scriptlet function to return the defaultAuthenticationMethods property rather than hardcoding it. The scriptlet could be doing the IP address range check, and then returning the AuthnContextClassRefPrincipal of the appropriate value for the password or Duo options.

That's probably how I would do it if I was adding this requirement to my current config with Duo, which is exclusively SP-driven.

The other way to do it is in some sense simpler, i.e. you can just stick it in a more complicated script rule in the MFA config when it decides when/how to do the Duo step. It's just that it's a bit more buried in a script that may not be as clear to somebody else looking at the config.

-- Scott