MFA flow and "forced" Duo signup

[Andrew Morgan]

On Thu, 24 May 2018, Losen, Stephen C. (scl) wrote:

> Hi folks,
>
> I have the MFA flow configured with a script that detects when the user 
> is required to use Duo but is not yet signed up.  In this situation the 
> MFA script result is null and as a side effect it sets the event 
> "DuoSignup" in the MFA Context.  I have configured an error message for 
> the "DuoSignup" event with a link to our Duo portal.  The Duo portal is 
> a Shib SP and I have special cased it in the MFA script so that Duo is 
> not required (otherwise the user is trapped, unable to access the 
> portal).
>
> With a fresh browser, everything works as expected.  I browse a SP, 
> login with my password, the MFA script detects that I must use Duo but 
> am not yet registered and displays the error message.  I click the link 
> to the Duo portal, and the username/password page appears again 
> (presumably because the previous login failed).  I enter my user/pass 
> and am logged in to the Duo portal, as expected.  But now my browser 
> apparently has a valid SSO session.  I can now access the original SP 
> without authenticating.
>
> Is there any way to allow access to the Duo portal without the side 
> effect of creating a SSO session ?  Some magic setting in the MFA 
> context?  Or an Auth Context Class config?

I think you need to set "idp.authn.favorSSO = false" in idp.properties so 
that the MFA flow will be run everytime.  Otherwise, the IDP will "prefer" 
an existing SSO session.

Thanks,
 	Andy