Forcing Duo by Service Provider

[Cantor, Scott]

On 3/29/17, 11:56 AM, "users on behalf of Brandon McKean" <users-bounces at shibboleth.net on behalf of mckeanbs at jmu.edu> wrote:

> I'm trying to find a good way to force Duo use through the MFA flow 
> within the code stanza.

That's not the right spot. You control it by setting the appropriate custom Principal inside the defaultAuthenticationMethods property on the relying party side, and in parallel requiring signed requests or blocking the RequestedAuthnContext "feature" for that SP, so that the imposed requirement can't be overridden. There are examples on that in the documentation.

> Here's what I'm wanting to change:

You don't want to change that, it's already correct for this case.

> What I'm wanting to do is force it by entityID. I thought that'd be 
> something done in the relying-party but I can't find any options for that.

See above.

Look at the RelyingPartyConfiguration topic, scroll down to the profile-specific configuration part, and click on, probably, the SAML 2 SSO link. That has sections covering different options, one of which is Authentication related settings, and this is covered there with a full example that's safe.

Of course, all of this is covering for a broken SP. The SP should be requesting this itself. (Not saying it's not necessary, but it's always important to understand this. When you talk about it, it's useful to emphasize to people that "hey, this application is broken" so they understand that you did work you shouldn't have had to do.)

-- Scott