MFA flow, Duo, and querying enrollment status

[Christopher Bongaarts]

On 1/16/2019 3:38 PM, Cantor, Scott wrote:
>> My guess is that the duo public api is about the same amount of reliable as the
>> one the iframe uses.  If one's gonna fail probably the other will.
> It's more to do with hanging requests in the IdP. The frame isn't the IdP calling them, it's the browser. Different failure mode. Like I said, I'm highly paranoid.

We did it like Jim except on 3.3 we rolled our own (read: backported 3.4 
code) HTTP client and built a DuoEnrollmentPredicate class.  We mitigate 
the risk somewhat by only doing the enrollment check for a limited 
period of tim. Similar to the "grace period" Stephen mentioned, we set 
our LDAP flag (actually a date) to 7 days out; prior to that, we check 
Duo to see if they've enrolled and enforce its use if they are.  Once 
the date in LDAP is reached, we always enforce Duo usage for that user, 
so we no longer have to check for enrollment.

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20190116/6abd13b8/attachment.html>