Headers for non-browser Duo auth in 3.4.3

[Wessel, Keith]

We're not using John's code any more. We removed all of that as part of our upgrade. However, the header names that you have in your duo-authn-beans.xml as well as the commented out defaults in duo.properties seem to be the same as what John's code looked for. Our developer told me what values he's using, and they do match what's in the duo-authn-beans.xml bean initialization params. Values are X-Shibboleth-Duo-Factor and X-Shibboleth-Duo-Passcode. We're not sending a device. We're supplying a factor of passcode and a passcode value from a ubikey to go with it, and the log is recording what I sent before: a factor of auto, device of auto, and no passcode.

No web server changes were made along with this upgrade.

Other than the debug-level output that I sent in my last message, I'm not sure what to turn up. I'd love to see what headers the IdP is receiving and what headers it's looking for, but I don't know how I'd go about that.

Thoughts?

Keith


-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: Thursday, February 28, 2019 3:04 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: Headers for non-browser Duo auth in 3.4.3

On 2/28/19, 3:44 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:

> We upgraded to IdP 3.4.3 this morning, and all seemed well until 
> someone came through using our AWS command-line login that utilizes 
> ECP and passes in the X-Shibboleth-Duo-Factor and X-Shibboleth-Duo-Passcode headers. This worked on 3.3.2 with John Pfeifer's DuoAuthAPI module. It's not working now, and the IdP seems to be ignoring the headers:

If you're still using his code and not the built-in code, I would imagine that could be a problem for reasons unknown, but if not, I know the new code works. I don't think the headers I used are named the same as they were in his contributed code, FWIW, but I don't know what they were. I just seem to recall changing them.

> Is there a bug? Or could there be come other reason that the IdP seems 
> to be ignoring the values of these headers getting passed in?

Web server I guess, but I've tested all the headers at different times.

-- Scott


--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net