Selecting Duo integration during MFA script

[Steven Premeau]

Chris -

  If the MFA flow is "always" going to select a Duo integration, it might
make more sense to perform the calculations and API calls within
the DuoIntegrationStrategy bean.  (I believe everything you would be
looking at via the MFA script is also available in DuoIntegrationStrategy.)

  Stuffing the results would certainly work, but might be overkill if they
are only going to be used once after calculation and not have any other
"long term" value.

Steve.

On Tue, Oct 8, 2024 at 4:33 PM Christopher Bongaarts via users <
users at shibboleth.net> wrote:

> I'd like to have my MFA script select between two different Duo
> integrations based on calculations and/or API calls happening as part of
> the MFA script (using the current DuoOIDC plugin on IdP 5.1.3).
>
> I think a reasonable approach would be to stuff the result in the
> AuthenticationContext, then make a
> shibboleth.authn.DuoOIDC.DuoIntegrationStrategy bean that inspects the
> result in the AuthenticationContext and returns the appropriate Duo
> integration.
>
> Any caveats to this approach, or suggestions on alternatives?
>
> --
> %%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
> %%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
> %%  University of Minnesota    %%  +1 (612) 625-1809    %%
>
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20241008/24dcd89b/attachment.htm>