passive authn and MFA

[Wessel, Keith]

I think I'm missing something. Why do you say the normal browser outcome would be NoPassive? I'm hoping to have a situation where, using the MFA flow, passive requests would be honored. That is, if the user already has a session, attributes would be returned, and if not, the user would be returned to the SP without attributes. But one of our SP admins attempted an  autn request today with passive set to true and got back a NoPassive error. He didn't yet have an IdP session. He's still trying to understand isPassive; I just introduced him to it today as it solves the problem he's trying to solve. But I don't want to send him down this route if our IdP isn't handling passive requests properly anymore because of something I did witho ur MFA flow.

Sorry if I'm being dense on this, but I'm not clear still on if I should just add passive support set to true for our Duo flow or not. We are using your packaged Duo flow and are on 3.4.

But is setting passive support to true for the duo flow going to give me what I want: a configuration that will honor passive requests?

Keith

-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: Wednesday, June 26, 2019 3:10 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: passive authn and MFA

On 6/26/19, 4:02 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:

> So, just to clarify, with the default behavior, the MFA flow will make sure all included flows honor passive before it
> chooses to honor it. Is that correct?

Before it runs them. With the old pre-MFA machinery in the IdP, if you had multiple login flows enabled, it would filter the set down by looking at a passive request and then throwing out any flows that didn't support passive. With the MFA flow, instead it does this filtering only at the point you tell it to run that login flow for you.

In terms of "honoring" IsPassive, all the MFA flow can do is apply it to the flows it runs, because it doesn't itself have a UI unless you build one yourself.

> And since I already have passive support enabled for password and MFA, is there any risk of enabling it for Duo?

The new version of my Duo flow does support it for non-browser use. Since it's now programmed for that, it is "safe" to use passively now because it shortcircuits itself before it will reach the iframe view. The pre-3.4 Duo flow would not be safe to toggle that flag on.

It depends what outcome you're looking for, but for a browser, the usual outcome is going to be NoPassive, which is what you're getting, so....dunno what difference you would expect but there probably won't be any.

-- Scott


-- 
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net