Duo in Shib 3.3

[Cantor, Scott]

On 6/22/18, 5:13 PM, "users on behalf of Clayton" <users-bounces at shibboleth.net on behalf of upnyhgb8v6 at snkmail.com> wrote:

> I never got to the point of triggering Duo for every SP - I found the setting that let's us enable it per-SP
> which is where I was trying to go in the first place.

The MFA flow orchestrates all that, the system operates by abstracting the whole concept into a set of Principal objects that represent the service's requirements and a set of parallel objects (in general-auth.xml) that represent the results of each login method, and matches them up at runtime to decide whether something is "enough" or not.

Password produces its set of objects and Duo its set, and if a service requires something the Password flow doesn't provide, the MFA flow is able to script the system to force Duo to be used when required and not otherwise.

> I think the examples I was looking at achieved this a different way.  They were defining "MFASAML2Principal"
>  beans and then referencing them in different places.  I don't understand the advantage of going that route.  More re-
> usable objects I guess? Maybe useful if you're also expecting some SP's to request MFA occaisonally?

That's one of the big reasons, yes. And because the system gets tied up in knots very fast if you try and enable both Password and MFA at the same time and rely on that sort of trick to get the right thing to run. Lots of failure modes will do things you don't expect and it will not end up broken in the end, but not in ways you're going to understand or notice just doing simple testing.

You don't touch that property under normal use, defaultAuthenticationMethods is the property that triggers explicit behavior for a service through the use of custom principals to represent what a service needs and what a method provides, and that's what all the examples follow.
 
-- Scott