MFA - Duo Configuration issue

[Cantor, Scott]

That has nothing to do with MFA. The NIH is continuing to set ForceAuthn in their requests and you have chosen to tell the IdP that Duo does not support ForceAuthn, which is up to you. That has nothing to do with the HowTo's topic, which is why it's not in there.

I don't know why NIH is continuing to do it, and I don't know whether they will do it in production or not.

The IdP defaults to Duo supporting ForceAuthn and has since it shipped Duo support. That means you (the collective you) chose to set that flag off.

-- Scott