Duo and SMS not supported

[Wessel, Keith]

No, there was no replaying with Maryland's code. You literally just had to hit the ECP endpoint twice, providing authentication headers twice. So, in the case of our awscli login module, you'd do one ECP auth providing a factor of SMS, and it would fail, but because the IdP still passed the request to the Duo Auth API, the SMS got sent. The API just returned with failed authentication which, obviously, the IdP passed on.

You would then do a second aws login command which would hit the ECP endpoint all over again. You had to re-enter your password and everything, but this time, you'd enter the code in the factor field instead of "sms".

So, I don't think there was any actual "getting it working." You just let it fail, but behind the scenes, Duo did its thing.

I'm glad to know that this is failing by design and wonder if it would be worthwhile to get it working again, clunky as it may be.

Keith


-----Original Message-----
From: users <users-bounces at shibboleth.net> On Behalf Of Cantor, Scott
Sent: Thursday, February 4, 2021 3:03 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: Duo and SMS not supported

On 2/4/21, 3:36 PM, "users on behalf of Wessel, Keith" <users-bounces at shibboleth.net on behalf of kwessel at illinois.edu> wrote:

>    Is there a reason this isn't supported? I agree that the having to log in twice was clunky, but we had users who liked it.

I don't know of any way to do it. The ECP code has no support for multiple round trips. If it was in Maryland's code, I don't know how it was done. Did it just fail the request but make the call to Duo anyway?

Note that in a true ECP scenario, there's still an AuthnRequest, but I understand that in scripts, that may be just a mock. In a true case, you couldn't replay the original.

There's nothing preventing using the codes, you just have to get them OOB. We have a simple portal for that here, I think.

-- Scott


-- 
For Consortium Member technical support, see https://urldefense.com/v3/__https://wiki.shibboleth.net/confluence/x/coFAAg__;!!DZ3fjg!p3zdNQQEi5f626jzl1Rpm-ZuGR4p8Yt5GWswiPdOZ_PQnRoFrZceW4jXQJwIo7WlFw$ 
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net