MFA - Duo Configuration issue

[Srinivas Voruganti]

Thank you David & Scott.

From: users <users-bounces at shibboleth.net> On Behalf Of IAM David Bantz
Sent: Tuesday, July 13, 2021 3:46 PM
To: Shib Users <users at shibboleth.net>
Subject: Re: MFA - Duo Configuration issue

FYI, that flag to support ForceAuthn is in:

…conf/authn/general-authn.xml


        <bean id="authn/Duo" parent="shibboleth.AuthenticationFlow"

                p:forcedAuthenticationSupported="true"

                p:nonBrowserSupported="false">



On 13Jul, 2021 at 11:36:07, Cantor, Scott <cantor.2 at osu.edu<mailto:cantor.2 at osu.edu>> wrote:
That has nothing to do with MFA. The NIH is continuing to set ForceAuthn in their requests and you have chosen to tell the IdP that Duo does not support ForceAuthn, which is up to you. That has nothing to do with the HowTo's topic, which is why it's not in there.

I don't know why NIH is continuing to do it, and I don't know whether they will do it in production or not.

The IdP defaults to Duo supporting ForceAuthn and has since it shipped Duo support. That means you (the collective you) chose to set that flag off.

-- Scott


--
For Consortium Member technical support, see https://wiki.shibboleth.net/confluence/x/coFAAg<https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwMFaQ&c=JeTkUgVztGMmhKYjxsy2rfoWYibK1YmxXez1G3oNStg&r=-CYQGhDCW_XVXWqNKPn5s07p1awyFSt0c0S-5qutrqc&m=nXDHFg8-LI78HHFjj2258aDLWt1DgFwt-KEWliRcpTc&s=kzeeeZRxw8kG-usMCWJ8XlQzlmxwanACUj36vf30QsA&e=>
To unsubscribe from this list send an email to users-unsubscribe at shibboleth.net<mailto:users-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210713/9288d75a/attachment.htm>