Map entityID to Duo Application Profile

[Cantor, Scott]

On 9/24/20, 11:18 AM, "users on behalf of Zunan Dong" <users-bounces at shibboleth.net on behalf of zunan.dong at utoronto.ca> wrote:

>    Currently, we use "DuoIntegrationMap" in duo-authn-config.xml to map entityID with Duo application profile. Every
> time we add a new entry to the map, we need to restart IdP to apply the change. Is there any way that can map an
> entityID to an existing Duo application profile bean without restarting IdP(The change will be applied dynamically)? 

Same answer I gave the other day: stop doing it that way and switch to using an EntityAttribute in the metadata as a tag to trigger a Predicate or Function that would produce the right answer.

A function-based approach that needs to care what the value of the EntityAttribute is is more complex than a condition/predicate just evaluating whether a value is true. Given that you probably have few integrations with Duo for this, a few predicates testing for a few values and then a simple if/else sequence in a script is probably good enough.

-- Scott