ECP on an idp configured for MFA

[Paul B. Henson]

> From: Cantor, Scott
> Sent: Tuesday, February 19, 2019 5:01 PM
> 
> It's using an override, not the default.

D'OH! It seems I once again been bitten by the "overrides must include all configuration, not just what's different than default" issue <sigh>. The SP I'm testing with is a R&S member, and I do have this override:

        <!-- R&S SP's should use persistent nameid's -->
        <bean parent="RelyingPartyByTag">
            <constructor-arg name="candidates">
                <list>
                    <bean parent="TagCandidate"
                          c:name="http://macedir.org/entity-category"
                          p:values="http://refeds.org/category/research-and-scholarship"/>
                </list>
            </constructor-arg>
            <property name="profileConfigurations">
                <list>
                    <bean parent="SAML2.SSO.custom"
                          p:nameIDFormatPrecedence="urn:oasis:names:tc:SAML:2.0:nameid-format:persistent" />
                </list>
            </property>
        </bean>

which indeed does not include the SAML2.ECP profile. I added <ref bean="SAML2.ECP" /> to the list and ECP worked with just password support. It would be nice to be able to specify a change to the default behavior without having to completely duplicate all the default behavior configuration over again :). Thanks for leading me to a mistake I've made before 8-/.

Now that base ECP is working, a few duo specific questions regarding it. The documentation says you can either create a separate application integration, or use your existing one that is in place for the MFA support? I tried to use the same integration, and was just getting forbidden from the duo service. I created a new integration for the auth API application, and that worked. My idp MFA integration is for the application "shibboleth", can that even be used for accessing the Auth API directly? If so, it seems odd they would have a separate Auth API application listed...

While I have both a token and a phone on my duol account, I have it configured to auto push to my phone. So it worked okay for me; but a lot of our users have only been issued a hardware token and don't necessarily set up their own phone. How does the Duo ECP support work if somebody needs to enter a passcode as part of the authentication? The documentation isn't very clear other than seeming to indicate it is possible?

Thanks much...