passive authn and MFA

[Cantor, Scott]

On 6/26/19, 9:33 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:

> I think I'm missing something. Why do you say the normal browser outcome would be NoPassive?

Because a passive request is meant to fail if the user would have to be prompted. The "failure" is the NoPassive SAML status, which is what the NoPassive event result will do.

> I'm hoping to have a situation where, using the MFA flow, passive requests would be honored. That is, if the user
> already has a session, attributes would be returned, and if not, the user would be returned to the SP without attributes.

That's what the SAML error does. You get returned with a failure status and the SP is responsible for dealing with that. So if that's what you want, you already have it.

> Sorry if I'm being dense on this, but I'm not clear still on if I should just add passive support set to true for our Duo flow
> or not. We are using your packaged Duo flow and are on 3.4.

I don't think it will make any difference. It wouldn't hurt if you want passive support for non-browser use, say with passcodes, but for general use cases it will be much the same.

> But is setting passive support to true for the duo flow going to give me what I want: a configuration that will honor
> passive requests?

I think you're misunderstanding what "honor" means here. The SAML error status is exactly the expected outcome if there's no session.

-- Scott