MFA flow, Duo, and querying enrollment status

[Andrew Morgan]

On Wed, 16 Jan 2019, James Oulman wrote:

> Good afternoon,
>
> We're upgrading from 3.2 where we are using a custom version of the Unicon 
> Duo integration[1]. I'm having trouble adapting our process to 3.4.
>
> We host an enrollment/management site which uses the Duo Device Management 
> Portal. Today users can either opt-in or for certain individuals we require 
> MFA. We calculate a 'should do MFA' attribute in our database where the data 
> is populated from the enrollment portal application or manually by an 
> administrator. When these 'should do MFA' users login to the 3.2 IdP, the 
> flow queries the Duo API and if they don't have an account, they are 
> presented with a 'NoDuoUser' view which explains to them that they need to 
> enroll (or finish enrolling devices) via our portal. There is a desire to 
> keep this user experience.
>
> In testing with 3.4, when the user sees the DuoWeb iframe and if they have 
> not enrolled a device they are given an error (I assume we have 
> self-enrollment disabled). I haven't found any watch to catch that error and 
> redirect them to another flow, or to query the API for their enrollment 
> status prior to handing them off to the authn/Duo flow. I also investigated 
> querying the API directly via an HTTPConnector but that did not look straight 
> forward with the way the API wants the Basic auth constructed.
>
> I've searched through the list archives and while I've seen a number of 
> promising threads, I didn't find exactly this scenario. I wanted to reach out 
> and see if anyone has done anything like this, can point me in the right 
> direction, or tell I'm going about this completely wrong.

James, see my thread from a week ago with subject "How to terminate MFA 
flow with an error?".

Instead of displaying the DuoWeb iframe, set an event and set 
nextFlow=null.  You can capture that event to display a customized error 
page instead of the default "Unable to meet the requirements" page.

If you want to see our configuration, just let me know.

Thanks,
 	Andy