MFA flow, Duo, and querying enrollment status

[Cantor, Scott]

> Instead of displaying the DuoWeb iframe, set an event and set nextFlow=null.
> You can capture that event to display a customized error page instead of the
> default "Unable to meet the requirements" page.

He's not (yet) properly using the MFA logic to control all this, the IFRAME is already being displayed. If it signals anything it's probably a generic ReselectFow event or something along those lines, I don't know offhand. If one assumed that was the reason it might be sufficient, but there are other reasons that could get triggered.

You would want to catch the situation before ever running the Duo flow. I personally would not call Duo's API to do it, I'd rely on local data to determine that, allowing more straightforward use of the attribute resolver via LDAP or some such to make the determination.

Calling Duo's API in a manner not already supported by the code is not going to be a matter of scripting. You'd have to write Java code, or you'd have to move all the logic to some other system and expose it as a REST call and then leverage the attribute resolver to make that call and get that proxied result.

Duo's API is not reliant on basic HTTP authentication, and that's why nothing out of the box will do it. The code to call that API is in 3.4 of course via the non-browser/ECP support, but it isn't exposed in a way that is supported for deployer use.

-- Scott