passive authn and MFA

[Wessel, Keith]

Yes, I was misunderstanding. It all goes back to my original question, and I got lost in the details. The original question was: does NoPassive mean there are no attributes to return? Is it the expected result for a user who doesn't have a session rather than something being misconfigured in my authn flows? Answer is yes, it means there are no attributes to return. Perfect! Thanks!

And thanks to the example from Switch on how to gracefully handle this situation on the wiki with Javascript.

Oh, and thanks for putting up with my confusion, Scott. :)

Keith


-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: Thursday, June 27, 2019 7:12 AM
To: Shib Users <users at shibboleth.net>
Subject: Re: passive authn and MFA

On 6/26/19, 9:33 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:

> I think I'm missing something. Why do you say the normal browser outcome would be NoPassive?

Because a passive request is meant to fail if the user would have to be prompted. The "failure" is the NoPassive SAML status, which is what the NoPassive event result will do.

> I'm hoping to have a situation where, using the MFA flow, passive 
> requests would be honored. That is, if the user already has a session, attributes would be returned, and if not, the user would be returned to the SP without attributes.

That's what the SAML error does. You get returned with a failure status and the SP is responsible for dealing with that. So if that's what you want, you already have it.

> Sorry if I'm being dense on this, but I'm not clear still on if I 
> should just add passive support set to true for our Duo flow or not. We are using your packaged Duo flow and are on 3.4.

I don't think it will make any difference. It wouldn't hurt if you want passive support for non-browser use, say with passcodes, but for general use cases it will be much the same.

> But is setting passive support to true for the duo flow going to give 
> me what I want: a configuration that will honor passive requests?

I think you're misunderstanding what "honor" means here. The SAML error status is exactly the expected outcome if there's no session.

-- Scott


--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net