passive authn and MFA

[Cantor, Scott]

On 6/26/19, 3:24 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:

> That's the default behavior that changed in 3.4 IIRC and the one that Andy Morgan pointed us to a few weeks back 
> when I was asking on this list about why our step-up authn broke.

No, I don't think so, this has never changed. That was an issue with how the flow result was checked for reuse.

> So, we have changed the default. Does that mean I need to set passive supported to tru for our Duo flow for passive to
> work?

No, the default is to honor the flow's own descriptions and settings. If the flow says it doesn't support passive, then the MFA flow won't run it for a passive request and will instead immediately trigger the NoPassive event, which either fails the whole request or would have to be handled with  a custom transition rule/step to turn it into something else. It just prevents the flow from having to run in a situation that's ordinarily not supposed to ever be allowed. If a flow is marked as not supporting passive, that's basically a contract with the IdP telling it that it had better never try that, and the MFA flow tries to honor that contract.

If you change that default, which has nothing to do with what your other thread was talking about, then the MFA flow's attempt to run the Duo flow will instead just run it, and do whatever the Duo flow itself is programmed or configured to do in whatever situation you run it in and the MFA flow doesn't guard against something unexpected happening.

Most of the login flows do not support passive because they can't really ensure that rule is followed. The Duo flow *can* be passive, but the IdP doesn't know it will be, and usually it's not. The Password flow of course pretty much never is.

The MFA flow, being essentially open ended, tends to need the deployer to set for the system whether or not it can properly handle passive, but this default behavior is there to make it "usually" do the right things if somebody does.

Usually passive really means "I hope the user's already logged in" and the default behavior lines up with that, but the options are there to change that.

-- Scott