Strange behavior in shibboleth regarding MFA

[Jeff Chapin]

We have Shibboleth set up to run a script to determine what the second
factor is for MFA.

I have two SPs, Portal and Java, both using the CAS protocol on Shibboleth.

When I open an incognito mode, and go to either of the URLs, I login and
use MFA normally.

If I open a new incognito mode, and go to Portal and THEN go to Java, the
script that determines what MFA second factor to use does not trigger at
all.

The issue is that Portal uses a Duo profile that allows  user to be
remembered for a full day, and the Java application is supposed to force
the user to run Duo each time they log in.

I'm assuming I am missing a 'force auth' setting somewhere -- cany pointers
on what to look at?



-- 

Jeff Chapin,

Panther eSports Adviser
Systems/Applications Administrator
ITS-IS, University of Northern Iowa
Phone: 319-273-3162 Email: Jeff.Chapin at uni.edu
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240618/82c42c94/attachment.htm>