Working example of using Duo AuthAPI/PreAuth call with Shibboleth IdP 5.1?

[Michael Grady]

> On May 9, 2024, at 10:15 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:
> 
>> The frustrating part is that it was "failing silently" in that the arguments we had before
>> for v4 just raised a "flow initialization" error without any further detail as to what it did
>> not like.
> 
> I'd have to see the log but I think it's more likely that you just couldn't digest a stack trace larger than a terrabyte. They get tricky to read.
> 
> Defining your own beans would have been the way to make it work, yes.
> 
> I suspect it was the HttpClient changes.
> 
> -- Scott
> 

So still having trouble getting the PreAuth call to Duo working in IdP 5.1.2. There is a ticket open with Duo about it, but the bottom line is that using the same Duo AuthAPi integration being used in IdP 4.x, the PreAuth call is getting back a 401 Unauthorized result, with this response (if I'm reading the log right):

  "{"code": 40103, "message": "Invalid signature in request credentials", "stat": "FAIL"}"

I can share HHTP client DEBUG lines, but is there any change in IdP 5/the HTTP Client/Java 17 that could cause a difference in the calculation of the Authorization: Basic header being sent in the PreAuth call to Duo?  Such that Duo would not like the HMAC-SHA1 value being calculated and sent?

--
Michael A. Grady
IAM Architect, Unicon, Inc.



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20240515/df55ca94/attachment.htm>