Headers for non-browser Duo auth in 3.4.3

[Wessel, Keith]

Hi, all,

We upgraded to IdP 3.4.3 this morning, and all seemed well until someone came through using our AWS command-line login that utilizes ECP and passes in the X-Shibboleth-Duo-Factor and X-Shibboleth-Duo-Passcode headers. This worked on 3.3.2 with John Pfeifer's DuoAuthAPI module. It's not working now, and the IdP seems to be ignoring the headers:

2019-02-28 14:24:37,670 - DEBUG [net.shibboleth.idp.authn.duo.impl.ExtractDuoAuthenticationFromHeaders:240] [session=3auiiioq3t0k1ifvoa5nexr2a] [ip=10.195.30.19] - Profile Action ExtractDuoAuthenticationFromHeaders: Duo AuthAPI parameters extracted from request (Factor: auto, Device: auto, Passcode: not set)

We aren't overriding any of the default header names in duo.properties. They're present but commented out. BTW, there's a typo in the line in that file defining the property for Passcode, line 24 of duo.properties that ships with the IdP:

# idp.duo.nonbrowser.header.factor = X-Shibboleth-Duo-Passcode

Should be:

# idp.duo.nonbrowser.header.passcode= X-Shibboleth-Duo-Passcode

But the code in system/flows/authn/duo-authn-beans.xml has the reight names associated with those headers, both property names and default values.

Is there a bug? Or could there be come other reason that the IdP seems to be ignoring the values of these headers getting passed in?

Thanks,
Keith