ECP on an idp configured for MFA

[Cantor, Scott]

On 2/19/19, 8:59 PM, "users on behalf of Paul B. Henson" <users-bounces at shibboleth.net on behalf of henson at cpp.edu> wrote:

>  It would be nice to be able to specify a change to the default behavior without having to completely duplicate all the
> default behavior configuration over again :).

You can, just inherit from beans containing the truly default behavior. There's also the metadata-driven way of doing all of this to avoid having multiple overrides that cross behavior.

> Now that base ECP is working, a few duo specific questions regarding it. The documentation says you can either create a
> separate application integration, or use your existing one that is in place for the MFA support?

I thought it was explicit that you have to have one with Auth API support but it wasn't. That works for both. WebSDK only does not.

> How does the Duo ECP support work if somebody needs to enter a passcode as part of the authentication? The
> documentation isn't very clear other than seeming to indicate it is possible?

It documents all the HTTP headers supported that provide control over the behavior and lists the default header names, all of which are arbitrary and changeable. It does not work well for tokens, that's just not practical unless the client deals with it, but it's functionally possible.

-- Scott