DuoOIDC ECP IntegrationStrategy

[Mak, Steve]

I have an IdP setup to talk to 2 different Duo integrations. I want one of them to be used for ECP clients. Is this the correct way to make my integration strategy? Is this even needed?

    <bean id="defaultDuo" parent="shibboleth.authn.DuoOIDC.DuoIntegration"
        p:APIHost="%{idp.duo.oidc.apiHost:none}"
        p:clientId="%{idp.duo.oidc.clientId:none}"
        p:secretKey="%{idp.duo.oidc.secretKey:none}"/>

    <bean id="ecpDuo" parent="shibboleth.authn.DuoOIDC.DuoIntegration"
        p:APIHost="%{idp.duo.oidc.nonbrowser.apiHost:none}"
        p:clientId="%{idp.duo.oidc.nonbrowser.integrationKey:none}"
        p:secretKey="%{idp.duo.oidc.nonbrowser.secretKey:none}"/>

    <util:map id="DuoIntegrationMap">
        <entry key="default" value-ref="defaultDuo"/>
        <entry key="ecp" value-ref="ecpDuo"/>
    </util:map>

    <bean id="shibboleth.authn.DuoOIDC.DuoIntegrationStrategy" parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript" p:customObject-ref="DuoIntegrationMap">
        <constructor-arg>
            <value><![CDATA[
                duo = null;
                profileCtx = input.getSubcontext("org.opensaml.profile.context.ProfileRequestContext");

                if (duo == null) {
                    duo = custom.get("default");
                }

                if (profileCtx && !profileCtx.isBrowserProfile()) {
                    duo = custom.get("ecp");
                }

                duo;
            ]]>
            </value>
        </constructor-arg>
    </bean>

Thanks,
Steve

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20230307/634153ff/attachment.htm>