MFA flow, Duo, and querying enrollment status

[James Oulman]

Good afternoon,

We're upgrading from 3.2 where we are using a custom version of the 
Unicon Duo integration[1]. I'm having trouble adapting our process to 3.4.

We host an enrollment/management site which uses the Duo Device 
Management Portal. Today users can either opt-in or for certain 
individuals we require MFA. We calculate a 'should do MFA' attribute in 
our database where the data is populated from the enrollment portal 
application or manually by an administrator. When these 'should do MFA' 
users login to the 3.2 IdP, the flow queries the Duo API and if they 
don't have an account, they are presented with a 'NoDuoUser' view which 
explains to them that they need to enroll (or finish enrolling devices) 
via our portal. There is a desire to keep this user experience.

In testing with 3.4, when the user sees the DuoWeb iframe and if they 
have not enrolled a device they are given an error (I assume we have 
self-enrollment disabled). I haven't found any watch to catch that error 
and redirect them to another flow, or to query the API for their 
enrollment status prior to handing them off to the authn/Duo flow. I 
also investigated querying the API directly via an HTTPConnector but 
that did not look straight forward with the way the API wants the Basic 
auth constructed.

I've searched through the list archives and while I've seen a number of 
promising threads, I didn't find exactly this scenario. I wanted to 
reach out and see if anyone has done anything like this, can point me in 
the right direction, or tell I'm going about this completely wrong.

Thanks!

1. https://github.com/Unicon/shib-mfa-duo-auth


-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3980 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/users/attachments/20190116/872d1833/attachment.p7s>