MFA flow, Duo, and querying enrollment status

[Losen, Stephen C (scl)]

Hi James,

We maintain an LDAP attribute for each user that indicates if they have registered for Duo.  We pretty much require everyone to use Duo, but we give new accounts a grace period to sign up for Duo.  We have our own Duo signup web app (uses Duo API) which twiddles the LDAP attribute.  And in case someone signs up using Duo directly (bypassing our app) we have a cron job that keeps the Duo roster and our LDAP accounts in sync.  We have a ton of Duo and LDAP accounts so this takes about 20 minutes to run.

In the MFA flow, if the user's LDAP record indicates Duo, then we invoke Duo.  Otherwise we do not (no point, Duo cannot work).  Then we use a Context Check intercept to enforce the grace period.  If the user is not signed up for Duo and their grace period has passed (another LDAP attr) then we trigger a "DuoSignup" event whose error message is a page with a link to our local Duo signup app.

If the user is not signed up for Duo and the grace period has not expired, but the SP requests Authn Context Class "https://refeds.org/profile/mfa", then the IDP automatically fails with a RequestUnsupported event.  Only Duo (and MFA) are configured to provide this ACC.

So this is what we do.  Maybe it will give you some ideas.

Stephen C. Losen
ITS - Systems and Storage
University of Virginia
scl at virginia.edu    434-924-0640


-----Original Message-----
From: users [mailto:users-bounces at shibboleth.net] On Behalf Of James Oulman
Sent: Wednesday, January 16, 2019 2:50 PM
To: Shib Users <users at shibboleth.net>
Subject: MFA flow, Duo, and querying enrollment status

Good afternoon,

We're upgrading from 3.2 where we are using a custom version of the 
Unicon Duo integration[1]. I'm having trouble adapting our process to 3.4.

We host an enrollment/management site which uses the Duo Device 
Management Portal. Today users can either opt-in or for certain 
individuals we require MFA. We calculate a 'should do MFA' attribute in 
our database where the data is populated from the enrollment portal 
application or manually by an administrator. When these 'should do MFA' 
users login to the 3.2 IdP, the flow queries the Duo API and if they 
don't have an account, they are presented with a 'NoDuoUser' view which 
explains to them that they need to enroll (or finish enrolling devices) 
via our portal. There is a desire to keep this user experience.

In testing with 3.4, when the user sees the DuoWeb iframe and if they 
have not enrolled a device they are given an error (I assume we have 
self-enrollment disabled). I haven't found any watch to catch that error 
and redirect them to another flow, or to query the API for their 
enrollment status prior to handing them off to the authn/Duo flow. I 
also investigated querying the API directly via an HTTPConnector but 
that did not look straight forward with the way the API wants the Basic 
auth constructed.

I've searched through the list archives and while I've seen a number of 
promising threads, I didn't find exactly this scenario. I wanted to 
reach out and see if anyone has done anything like this, can point me in 
the right direction, or tell I'm going about this completely wrong.

Thanks!

1. https://github.com/Unicon/shib-mfa-duo-auth