How to terminate MFA flow with an error?

[Losen, Stephen C. (scl)]

Hi folks,

I am using Duo and the MFA flow. If a user has registered with Duo then we set a "duo-enabled" attribute for the user in LDAP. Sending a non-registered user to Duo is pointless, it cannot succeed.

We also have a grace period for new folks to register with Duo and we have a "duo-deadline" LDAP attribute (YYYY/MM/DD).

Our policy goes like this. If duo-enabled is true, then we invoke Duo, regardless of the relying party, or any other user attributes.

If duo-enabled is not true then we conditionally let authn succeed without Duo. The duo-deadline must not be passed and the "mfaCtx.isAcceptable()" test must be true (some SPs require Duo).  Otherwise, then what?

I have this logic coded in a MFA script, but I'm not sure what is the best way to handle the "error case" where the first factor (Password) alone is not sufficient, but the user is not registered with Duo.

I have a rather ugly solution where the script sets the next flow to "authn/error" (undefined flow) and that definitely stops MFA dead in its tracks.  However, the IDP itself does not display an error (which I could customize) and instead it responds to the SP with an error, so your browser shows a cryptic error from the SP.

In this error situation I would like to display a page with a link to our "Duo portal" app where you can sign up for Duo.

Any better suggestions for going about this?

Our Duo portal app is a Shib SP so I will need to tweak my MFA logic to allow single-factor access to this SP even after the duo-deadline has passed. 

Stephen C. Losen
ITS - Systems and Storage
University of Virginia
scl at virginia.edu    434-924-0640