DuoOIDC HTTP Proxy

[Sean Mason]

Hello there!

I'm attempting to get the new DuoOIDC module working in an upgraded instance of Shibboleth 4.1.0.
The machine the instance is running on does not have a direct route to the wider internet.  When DuoOIDC's turn comes up in the MFA flow there is an attempt to connect to a Duo service to perform a health check (HealthCheckDuoOIDCAuthAPI) it fails with 'no route to host'.

To work around this for metadata sources I've been able to configure a proxy.  I've made an assumption that I could do the same to resolve this issue, but perhaps that is a bad assumption and I'd know better if I understood the OIDC protocol better?  If the assumption is valid, how would I go about configuring DuoOIDC to use a proxy?

My latest attempt has me defining the "shibboleth.authn.DuoOIDC.NonBrowser.HttpClient" bean in conf/authn/duo-oidc-authn-config.xml to be:
<bean id="shibboleth.authn.DuoOIDC.NonBrowser.HttpClient"
  parent="shibboleth.HttpClientFactory"
  p:connectionProxyHost="--proxy-host--"
  p:connectionProxyPort="--proxy-port--" />

I've also tried various conf/services.properties and conf/authn/duo-oidc.properties entries such as:
idp.duo.oidc.proxyHost
idp.duo.oidc.connectionProxyHost
idp.httpclient.proxyHost
idp.httpclient.connectionProxyHost
... etc.

I've tried passing JVM startup options (-Dhttps.proxyHost, etc.) as well without any luck.

Guidance would be greatly appreciated!
Sean.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20210519/e2a4a85e/attachment.htm>