Working example of using Duo AuthAPI/PreAuth call with Shibboleth IdP 5.1?

[Christopher Bongaarts]

On 5/8/2024 10:35 AM, Michael Grady via users wrote:
> I'm having trouble with getting  the DuoPreauthAuthenticator working in the MFA logic code (mfa-authn-config.xml)  for IdP 5.1.2. A use of it that worked fine in IdP 4.3. Just wondering if anyone already has a working example of using a PreAuth call in IdP 5.1?

Here's the test() method from a custom IsDuoEnrolled predicate we invoke 
from the MFA script that uses the DuoPreauthAuthenticator; is this helpful?

     public boolean test(@Nullable final ProfileRequestContext input) {
         duoIntegration = duoIntegrationLookupStrategy.apply(input);
         if (duoIntegration == null) {
             log.warn("{} No DuoIntegration returned by lookup strategy");
             return false;
         }

         username = usernameLookupStrategy.apply(input);
         if (username == null) {
             log.warn("{} No principal name available for Duo enrollment 
check");
             return false;
         }

         // create an ephemeral duo request context
         final DuoAuthenticationContext duoContext = new 
DuoAuthenticationContext();
         duoContext.setUsername(username);

         final DuoPreauthAuthenticator preAuther = new 
DuoPreauthAuthenticator();
         try {
             log.debug("Invoking Duo Auth API preauth for username {}", 
username);
             DuoPreauthResponse response = 
preAuther.authenticate(duoContext, duoIntegration);
             String result = response.getResult();
             log.debug("Preauth result: {}", result);

             // "enroll" means they don't exist; anything else means they do
             return !result.equals(DuoAuthAPI.DUO_PREAUTH_RESULT_ENROLL);

         } catch (final DuoException e) {
             final String errMsg = "Error invoking Duo auth API";
             log.error(errMsg, e);
             return false;
         }
     }
}

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%