Duo in Shib 3.3

[Cantor, Scott]

On 6/22/18, 2:13 PM, "users on behalf of Losen, Stephen C. (scl)" <users-bounces at shibboleth.net on behalf of scl at virginia.edu> wrote:

> You need to configure Multi Factor Authn (MFA).  You probably want it to run Password Authn first and then run Duo.  
> And of course you must configure Duo.  If the IDP is currently  running Password directly, then run MFA instead.

Relevant material being [1].

The reason you don't see the "big picture" in the Duo topic is that Duo isn't a stand-alone solution, it's a single factor, not MFA. That tells you how to configure Duo to work but not how to combine it with other factors, and that's what most people want to do.

The default examples for MFA that the software ships with are more than a simple use case for just running Password+Duo actually require but they're easily reducible to that. The Duo flow will automatically make use of the identity produced by the Password flow if that's the use case and there's nothing much to configure for that to work.

-- Scott

[1] https://wiki.shibboleth.net/confluence/display/IDP30/MultiFactorAuthnConfiguration