Shibboleth 4.2.1 and Duo with Nimbus Client issues

[Hong Ye]

Hi Jeff,



In authn/mfa-authn-config.xml, have you set the flow to use DuoOIDC?

nextFlow = "authn/DuoOIDC";


Hong


From: users <users-bounces at shibboleth.net> on behalf of Jeff Chapin via users <users at shibboleth.net>
Date: Wednesday, January 18, 2023 at 10:58 AM
To: Shib Users <users at shibboleth.net>
Cc: Jeff Chapin <jeff.chapin at uni.edu>
Subject: Shibboleth 4.2.1 and Duo with Nimbus Client issues
All,

I am in the process of installing Shibboleth 4.2.1, and I am attempting to configure Duo (via the Nimbus client), and I am running into issues.

I have installed the module, and I have configured a custom Http Client to work with out outbound proxy. I *appear* to be communicating with Duo, but I am getting the following error from Duo in response to the health check:


2023-01-12 13:48:57,330 - 10.1.142.23 - DEBUG [org.apache.http.wire:87] - http-outgoing-0 << "{"stat": "FAIL", "code": 40002, "timestamp": 1673552937, "message": "invalid_client", "message_detail": "Failed to verify signature."}"

This leads me to believe that we are correctly contacting Duo -- but it does not like what we are sending.

My duo-oidc.properties contains:
idp.duo.oidc.apiHost = api-REDACTED.duosecurity.com<http://api-REDACTED.duosecurity.com>
idp.duo.oidc.clientId = DREDACTEDA
idp.duo.oidc.redirectURL = https://REDACTED.uni.edu/idp/profile/Authn/Duo/2FA/duo-callback
idp.duo.oidc.audit.enabled = true

My secret.properties contains:
idp.duo.oidc.secretKey = 9REDACTEDX



I have confirmed that the clientID and the secretKey match the Client ID and Client Secret in the Duo control panel, and that the Universal Prompt is enabled for this pool.


We have MFA set in our idp.properties:
idp.authn.flows= MFA

and we are specifying nextFlow = "authn/DuoOIDC"; in our checkSecondFactor script, so it should be using this config.

This brings me to my questions:
1) Is there anything obvious I am overlooking?
2) Is there any way to crank up the logging for net.shibboleth.idp.plugin.authn.duo.nimbus so that I can see what clientID we are sending to Duo? If we are pulling that value from somewhere else, seeing what is sent would help locate *where*

Thanks for your time,
Jeff

--

Jeff Chapin,
Panther eSports Adviser
Systems/Applications Administrator
ITS-IS, University of Northern Iowa
Phone: 319-273-3162 Email: Jeff.Chapin at uni.edu<mailto:Jeff.Chapin at uni.edu>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230118/e2f292e4/attachment.htm>