Device Enrollment Screen for Duo

[Cantor, Scott]

On 9/17/18, 9:56 AM, "users on behalf of Karla Borecky" <users-bounces at shibboleth.net on behalf of kborecky at smith.edu> wrote:

> For our Duo rollout, I wrote a php program for people to sign up for Duo. They have to re-auth through shibboleth, 
> and then I present them with a (brief) explanation of what is going to happen. Once they agree, it puts them in the ?
> synched Duo windows group.

We did a lower tech version of that, essentially, just threw a page up under an SP in PHP to show the iframe independently of the IdP login step.

> I think one point of confusion here was Duo's described "self-enrollment," which sounds like you can decide to start
> using Duo using some onscreen Duo process. This is not really the case (unless something has changed.) You are
> either in a Duo group or you're not. 

No, that's a choice. You can be added on the fly if you set Duo up that way (and we did).

-- Scott