Odd Duo Exception after upgrading to 3.3.0 from 3.2.0

[Christopher Bongaarts]

On 3/16/2017 11:18 PM, Michael A Grady wrote:
> I'd be interested to know what the reasons are why you would rather 
> get the Unicon plugin working with 3.3.x than switch to the now 
> built-in support for such with the combo of the MFA and Duo flows? 
> There are no features in our Unicon plugin that at least I'd had 
> occasion to leverage for deployments that I wasn't also able to 
> configure with the new MFA/Duo support in IdP 3.3.x. Is it simply the 
> "learning curve" of how to configure it the "new way" versus the "old 
> way"? Or is there something you could do with the Unicon plugin that 
> you don't think you can do with the new MFA/Duo support?

In this case the specific goal was to get the upgrade out with as few 
changes as possible from our current configuration, in order to minimize 
the likelihood of behavior differences.  Just trying to reduce the scope 
of potential issue.

Now that we've got 3.3.0 in production, we plan to take a little more 
time to convert over to the native Duo and MFA flows, and probably do 
some more deV2ification of our other config files. Might get 3.3.1 out 
in prod first, though.

My understanding is that the new Duo/MFA stuff is capable of doing what 
we need, which right now is just honoring our custom 
RequestedAuthnContext and reporting it back as the used context. We're 
not doing anything user-specific, nor any fancy authn context mappings 
or such (yet).

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%