MFA flow, Duo, and querying enrollment status

[Jim Fox]

> You would want to catch the situation before ever running the Duo flow. I personally would not call Duo's API to do it, I'd rely on local data to determine that, allowing more straightforward use of the attribute resolver via LDAP or some such to make the determination.
>
> Calling Duo's API in a manner not already supported by the code is not going to be a matter of scripting. You'd have to write Java code, or you'd have to move all the logic to some other system and expose it as a REST call and then leverage the attribute resolver to make that call and get that proxied result.
>
> Duo's API is not reliant on basic HTTP authentication, and that's why nothing out of the box will do it. The code to call that API is in 3.4 of course via the non-browser/ECP support, but it isn't exposed in a way that is supported for deployer use.


We call Duo's API to see if a user has Duo.  It assures that we have up-to-the-minute information.  It's quite simple, something like:

   var Http = Java.type("com.duosecurity.client.Http");
   ...
     var request = new Http("POST", "%{uw.idp.duo.api.apiHost:none}", "/auth/v2/preauth", 10);
     request.addParam("username", <user's id>);
     request.signRequest("%{uw.idp.duo.api.integrationKey:none}", "%{uw.idp.duo.api.secretKey:none}");
     ret = request.executeHttpRequest();

and then look at the returned json doc.

Jim