MFA flow and "forced" Duo signup

[Losen, Stephen C. (scl)]

Hi folks,

Thanks for the suggestions.  I ended up creating a post auth intercept flow that determines if the user should go to our Duo management portal. This generates a "DuoSignup" event where the IDP displays an error message with a link to our Duo mgmt portal.

In the MFA transition map I conditionally invoke authn/Duo if the user has a "duo-enabled" attribute (without regard for the SP or the authn request).

In the intercept, if duo-enabled is set, then I assume that authn/Duo ran, and the intercept returns true (no error).  Otherwise if the Duo signup deadline has passed, the intercept returns false, causing the "DuoSignup" event.  However if the SP is the Duo mgmt portal, then the intercept returns true (so the user doesn't get trapped). 

Stephen C. Losen
ITS - Systems and Storage
University of Virginia
scl at virginia.edu    434-924-0640


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of Cantor, Scott
Sent: Friday, May 25, 2018 1:05 PM
To: Shib Users <users at shibboleth.net>
Subject: RE: MFA flow and "forced" Duo signup

> I think you need to set "idp.authn.favorSSO = false" in idp.properties so that the
> MFA flow will be run everytime.  Otherwise, the IDP will "prefer"
> an existing SSO session.

It's a workaround described in the documentation.

https://wiki.shibboleth.net/confluence/display/IDP30/MultiFactorAuthnConfiguration#MultiFactorAuthnConfiguration-ReuseoftheEntireauthn/MFAFlowResult(WhenIsaMFANextFlowStrategyExecuted?)

-- Scott

-- 
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net