MFA flow and "forced" Duo signup

[Losen, Stephen C. (scl)]

Hi folks,

I have the MFA flow configured with a script that detects when the user is required to use Duo but is not yet signed up.  In this situation the MFA script result is null and as a side effect it sets the event "DuoSignup" in the MFA Context.  I have configured an error message for the "DuoSignup" event with a link to our Duo portal.  The Duo portal is a Shib SP and I have special cased it in the MFA script so that Duo is not required (otherwise the user is trapped, unable to access the portal).

With a fresh browser, everything works as expected.  I browse a SP, login with my password, the MFA script detects that I must use Duo but am not yet registered and displays the error message.  I click the link to the Duo portal, and the username/password page appears again (presumably because the previous login failed).  I enter my user/pass and am logged in to the Duo portal, as expected.  But now my browser apparently has a valid SSO session.  I can now access the original SP without authenticating.

Is there any way to allow access to the Duo portal without the side effect of creating a SSO session ?  Some magic setting in the MFA context?  Or an Auth Context Class config?
 

Stephen C. Losen
ITS - Systems and Storage
University of Virginia
scl at virginia.edu    434-924-0640