failmode in IdP v3.3 Native Duo Plugin

[Cantor, Scott]

On 7/24/17, 5:12 PM, "users on behalf of Jesse Martinich" <users-bounces at shibboleth.net on behalf of martinicj at sou.edu> wrote:

> My reading of this document (https://wiki.shibboleth.net/confluence/pages/viewpage.action?pageId=32112643) implies the
> existence of the setting "idp.duo.failmode" in the native plugin. 

I can't speak for that since it is not our documentation, but no, it's not supported. It's orthogonal to the implementation because it has nothing to do with Duo, it's a configurable choice you make when you implement your MFA scripting. You can handle errors resulting from any of the factors any way you choose. If there's some sort of generality to it that people would like to see implemented, that hasn't been requested, but it would not be anything to do with Duo itself.

> If not, am I correct in assuming that a failed flow (if authn/Duo fails to reach the Duo server) will result in a failed authentication?

If you don't script something different from that, yes.

> I am sure that how you script it matters a whole heck of a lot.

It's everything.

> I am essentially using the example MFA setup with "checkSecondFactor", but mine uses Password, then Duo, and a different
> attribute. If the attribute indicates to include authn/Duo as next flow, and that flow fails, should I expect a failed auth?

If you don't handle whatever event ID is signaled in that case, then it will fall through and become the result of the overall authentication flow, unless it's something customized but that hasn't been defined as a legal event for the system to handle (which results in a system error of sorts). But pretty much anything we built in gets propagated out as a final result, and anything but "proceed" results in failure. What happens after that depends on your overall error handling config.

-- Scott