MFA flow, Duo, and querying enrollment status

[James Oulman]

On 1/16/19 3:32 PM, Cantor, Scott wrote:

>> Instead of displaying the DuoWeb iframe, set an event and set nextFlow=null.
>> You can capture that event to display a customized error page instead of the
>> default "Unable to meet the requirements" page.
> 
> He's not (yet) properly using the MFA logic to control all this, the IFRAME is already being displayed. If it signals anything it's probably a generic ReselectFow event or something along those lines, I don't know offhand. If one assumed that was the reason it might be sufficient, but there are other reasons that could get triggered.
> 
> You would want to catch the situation before ever running the Duo flow. I personally would not call Duo's API to do it, I'd rely on local data to determine that, allowing more straightforward use of the attribute resolver via LDAP or some such to make the determination.
> 
> Calling Duo's API in a manner not already supported by the code is not going to be a matter of scripting. You'd have to write Java code, or you'd have to move all the logic to some other system and expose it as a REST call and then leverage the attribute resolver to make that call and get that proxied result.
> 
> Duo's API is not reliant on basic HTTP authentication, and that's why nothing out of the box will do it. The code to call that API is in 3.4 of course via the non-browser/ECP support, but it isn't exposed in a way that is supported for deployer use.
> 

Thanks, Scott (and Andrew/Stephen) for the replies.

Yes, you hit the nail on the head. If I had local data about their 
provisioning status this would be much more straight forward.

Confirming that we have limited options for querying the Duo API 
directly from the IdP is very helpful.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3980 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://shibboleth.net/pipermail/users/attachments/20190116/9c062afc/attachment.p7s>