Strange behavior in shibboleth regarding MFA

[Cantor, Scott]

> The issue is that Portal uses a Duo profile that allows user to
> be remembered for a full day, and the Java application is
> supposed to force the user to run Duo each time they log in.

You need to use separate Duo integrations (which you did), but you also have to attach different custom AuthnContextClassRef custom Principals to the integration objects, and select them in a script on the basis of which one satisfies a given request.

Then you need drive that by attaching requirements with the defaultAuthenticationMethods profile setting so that the selection of the integration to use for Duo will be based on what the service needs.

There are examples of that in the multiple integrations section of the Duo docs.

> I'm assuming I am missing a 'force auth' setting somewhere -

ForceAuthn is meant to bypass SSO entirely, that's not what you're asking about.

-- Scott