> Thanks; with those hints and lots of source code reading, this addition to duo-oidc >-authn-config.xml did the trick (for IdP 4.1.7+DuoOIDC 1.1.1): You're welcome to add that to the HttpClientConfiguration page as an example. The same syntax should work for 5.x too. -- Scott