Shibboleth 4.2.1 and Duo with Nimbus Client issues

[Jeff Chapin]

Yes, we do have that set --- which I *THINK* we can confirm with the fact
that it is trying to run the Health Check, and failing.

Out of curiosity, I have changed the nextFlow to null, and tested -- we
successfully log into the test SP, and we don't see any Duo related logs in
idp-process.log, so I think we are executing the right plugin....

Jeff

On Wed, Jan 18, 2023 at 10:14 AM Hong Ye via users <users at shibboleth.net>
wrote:

> Hi Jeff,
>
>
>
> In authn/mfa-authn-config.xml, have you set the flow to use DuoOIDC?
>
> nextFlow = "authn/DuoOIDC";
>
>
>
> Hong
>
>
>
>
>
> *From: *users <users-bounces at shibboleth.net> on behalf of Jeff Chapin via
> users <users at shibboleth.net>
> *Date: *Wednesday, January 18, 2023 at 10:58 AM
> *To: *Shib Users <users at shibboleth.net>
> *Cc: *Jeff Chapin <jeff.chapin at uni.edu>
> *Subject: *Shibboleth 4.2.1 and Duo with Nimbus Client issues
>
> All,
>
>
>
> I am in the process of installing Shibboleth 4.2.1, and I am attempting to
> configure Duo (via the Nimbus client), and I am running into issues.
>
> I have installed the module, and I have configured a custom Http Client to
> work with out outbound proxy. I *appear* to be communicating with Duo, but
> I am getting the following error from Duo in response to the health check:
>
>
>
> 2023-01-12 13:48:57,330 - 10.1.142.23 - DEBUG [org.apache.http.wire:87] - http-outgoing-0 << "{"stat": "FAIL", "code": 40002, "timestamp": 1673552937, "message": "invalid_client", "message_detail": "Failed to verify signature."}"
>
>
> This leads me to believe that we are correctly contacting Duo -- but it
> does not like what we are sending.
>
> My duo-oidc.properties contains:
>
> idp.duo.oidc.apiHost = api-REDACTED.duosecurity.com
>
> idp.duo.oidc.clientId = DREDACTEDA
>
> idp.duo.oidc.redirectURL =
> https://REDACTED.uni.edu/idp/profile/Authn/Duo/2FA/duo-callback
>
> idp.duo.oidc.audit.enabled = true
>
> My secret.properties contains:
>
> idp.duo.oidc.secretKey = 9REDACTEDX
>
>
>
>
>
>
>
> I have confirmed that the clientID and the secretKey match the Client ID
> and Client Secret in the Duo control panel, and that the Universal Prompt
> is enabled for this pool.
>
>
> We have MFA set in our idp.properties:
>
> idp.authn.flows= MFA
>
>
>
> and we are specifying nextFlow = "authn/DuoOIDC"; in our checkSecondFactor
> script, so it should be using this config.
>
> This brings me to my questions:
>
> 1) Is there anything obvious I am overlooking?
>
> 2) Is there any way to crank up the logging for
> net.shibboleth.idp.plugin.authn.duo.nimbus so that I can see what clientID
> we are sending to Duo? If we are pulling that value from somewhere else,
> seeing what is sent would help locate *where*
>
> Thanks for your time,
>
> Jeff
>
>
>
> --
>
> Jeff Chapin,
>
> Panther eSports Adviser
> Systems/Applications Administrator
> ITS-IS, University of Northern Iowa
> Phone: 319-273-3162 Email: Jeff.Chapin at uni.edu
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>


-- 

Jeff Chapin,

Panther eSports Adviser
Systems/Applications Administrator
ITS-IS, University of Northern Iowa
Phone: 319-273-3162 Email: Jeff.Chapin at uni.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230118/625d2961/attachment.htm>