Duo plugin 1.3 - Duo Health Check and the recent Duo outage on 21 AUG 2023

[Philip Smart]

 On 21 AUG 2023 Duo had a major outage. In the Duo plugin documentation there exists a section for Duo Health Check and it implies that if Duo is down then the Duo redirect is skipped. However, I did not see that happening during the Duo outage and I'm wondering if either: 1) I misconfigured something 2) my expectations are incorrect or 3) the outage didn't apply to this feature.

Link to the outage postmortem: https://status.duo.com/incidents/rw7g0q7ztj8f

I have left the duo property for 'idp.duo.oidc.healthcheck.enabled' commented out by default, so I it is enabled in my systems.

This is sensible. The Health check not only checks the service is available, but that your client is active. It should be enabled by default as Duo say you should call it before every 2FA attempt as part of their workflow. Technically it is not required for the 2FA to be performed, hence the option to turn it off (but leave it on). It should however 'fail closed’ (skip the redirect) if that check either produces an error from Duo's response, or the client experiences an IO exception. If it did not, that would be a bug I suspect.

It should be logged as 'Duo API health check failed’ and give a reason, and give an AuthenticationException.

I’ll see if I can fake this to test it (beyond the unit tests it has).

Phil


Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under company number. 05747339, VAT number GB 197 0632 86. Jisc’s registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.


Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 02881024, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.


Jisc Commercial Limited is a wholly owned Jisc subsidiary and a company limited by shares which is registered in England under company number 09316933, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.


For more details on how Jisc handles your data see our privacy notice here: https://www.jisc.ac.uk/website/privacy-notice
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230829/9aab6edd/attachment.htm>