Headers for non-browser Duo auth in 3.4.3

[Wessel, Keith]

Scott,

You were right.

I did already have that line on line 55 of the duo-authn-beans.xml that shipped with 3.4.3. So, that wasn't the problem.

And yes, you did change the header names. John had one b in Shibboleth in all the default header names, and I never overrode that with the correct spelling. I had my developer send me the headers he was sending, and I saw X-Shiboleth-Duo-Factor and X-Shiboleth-Duo-Passcode. He corrected that, and it works now.

Thanks for the direction on this.

If anyone else on this list is using University of Illinois' Shibboleth ECP module for the AWS CLI login, our developer will be pushing out a fix to Pypy next week to correct this, and will make the headers sent configurable with the defaults matching the values that IdP 3.4.X looks for.

Keith


-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: Thursday, February 28, 2019 3:24 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: Headers for non-browser Duo auth in 3.4.3

On 2/28/19, 4:16 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:

> Other than the debug-level output that I sent in my last message, I'm not sure what to turn up. I'd love to see what
> headers the IdP is receiving and what headers it's looking for, but I don't know how I'd go about that.

Short of a packet trace, the best thing is just to test it with a browser and an extension, or curl, or something that can send known headers and trace that.

I've tested both ways and never had any problems with it.

The latest code has this line in the Spring bean you apparently looked at:

        p:httpServletRequest-ref="shibboleth.HttpServletRequest"

That line missing is the only non-external facor that would prevent the code from getting at the headers if they're there.

What exact headers does he think he's sending? It's possibly my code does different things with them than John's did, and something is circumventing the behavior.

-- Scott


-- 
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net