Forcing Duo by Service Provider

[Cantor, Scott]

On 3/29/17, 3:35 PM, "users on behalf of Brandon McKean" <users-bounces at shibboleth.net on behalf of mckeanbs at jmu.edu> wrote:

> Ok, can you point to a working sample configuration that I can study? 

The example is showing (one way) to configure the relying-party half of the equation. It assumes you already have the authentication half done. The example constant is simply a stand-in for "the real Principal you already put inside the authentication flow descriptors". If you didn't do that step, or they don't line up, then it's not going to work and it will refuse to run any login flows, which is what it did.

Both the MFA flow and the Duo flow have to support the AuthnContextClassRefPrincipal you pick. The MFA flow so it runs, and the Duo flow so it produces a Subject result that contains that Principal automatically.

Nobody but you can select the constant to use. There is no standard constant.

The Duo flow descriptor in general-authn.xml in 3.3 includes almost (*) the same example Principal I included in the relying-party example. Right in the file it says:

            <!--
            The list below should be changed to reflect whatever locally- or
            community-defined values are appropriate to represent MFA. It is
            strongly advised that the value not be specific to Duo or any
            particular technology.
            -->

(*) This is where I made an error. The constant I used in the Duo flow descriptor as a placeholder does not exactly match the example in the wiki. That was an accident, I'll fix the wiki. But on the other hand, if it "just worked", you'd be using a constant you shouldn't be using. You have to understand why you're doing all this to be operating this correctly. Pasting bogus constants doesn't help anybody.

All you have to do is pick something you own as a constant, replace the example.org constants with the one you pick, and adjust the MFA supportedPrincipals collection with the union of the two flows it's merging results from.
 
-- Scott