NIH logins fail to detect MFA after DUO Universal Prompt upgrade.

[Cantor, Scott]

> We recently upgraded our Shibboleth installation to leverage DUO Universal
> Prompt and logins are failing with Access Denied Login to NIH systems
> requires multi-factor authentication (MFA).

Moving to the UP is not precisely an "upgrade", it's a lateral change from one login flow to another in the IdP that are configured separately. If it was working before, then you configured the original Duo flow to support the REFEDS profile SAML context class and you failed to do so for the new flow, which is not going to just happen automatically.

Maryland is a consortium member, so if you need more help than that, please leverage the appropriate support mechanisms for that. I will contact you offline with the person you would control that access.

-- Scott