MFA flow, Duo, and querying enrollment status

[Cantor, Scott]

> We call Duo's API to see if a user has Duo.  It assures that we have up-to-the-
> minute information.  It's quite simple, something like:

Perfect, didn't know it would be that simple to script.

You'd want to be aware that you're counting on the networking/timeout behavior of an HTTP client sitting inside Duo's code there. I'm incredibly paranoid to the point of obsession with never relying on unvetted networking code.

-- Scott