Map entityID to Duo Application Profile

[Zunan Dong]

Thanks Scott, this is helpful.

A follow-up question, if I add an "EntityAttribute" in the metadata. How can I get that attribute from duo-authn-config.xml, specifically, "DuoIntegrationStrategy"?


Zunan Dong

Authentication Systems Specialist

Information Security

Information Technology Service

University of Toronto

Email: zunan.dong at utoronto.ca


________________________________
From: users <users-bounces at shibboleth.net> on behalf of Cantor, Scott <cantor.2 at osu.edu>
Sent: Thursday, 24 September 2020 12:05
To: Shib Users <users at shibboleth.net>
Subject: Re: Map entityID to Duo Application Profile

EXTERNAL EMAIL:  Treat content with extra caution.

On 9/24/20, 11:18 AM, "users on behalf of Zunan Dong" <users-bounces at shibboleth.net on behalf of zunan.dong at utoronto.ca> wrote:

>    Currently, we use "DuoIntegrationMap" in duo-authn-config.xml to map entityID with Duo application profile. Every
> time we add a new entry to the map, we need to restart IdP to apply the change. Is there any way that can map an
> entityID to an existing Duo application profile bean without restarting IdP(The change will be applied dynamically)?

Same answer I gave the other day: stop doing it that way and switch to using an EntityAttribute in the metadata as a tag to trigger a Predicate or Function that would produce the right answer.

A function-based approach that needs to care what the value of the EntityAttribute is is more complex than a condition/predicate just evaluating whether a value is true. Given that you probably have few integrations with Duo for this, a few predicates testing for a few values and then a simple if/else sequence in a script is probably good enough.

-- Scott


--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20200924/f6a52b7b/attachment.htm>