Selecting Duo integration during MFA script

[Christopher Bongaarts]

A good suggestion, but there is a Duo API call that needs to happen in 
the MFA script to decide whether to invoke the Duo auth in the first 
place that I would prefer not to have to duplicate within the 
integration strategy...

On 10/8/2024 4:10 PM, Steven Premeau wrote:
> Chris -
>
>   If the MFA flow is "always" going to select a Duo integration, it 
> might make more sense to perform the calculations and API calls within 
> the DuoIntegrationStrategy bean.  (I believe everything you would be 
> looking at via the MFA script is also available in 
> DuoIntegrationStrategy.)
>
>   Stuffing the results would certainly work, but might be overkill if 
> they are only going to be used once after calculation and not have any 
> other "long term" value.
>
> Steve.
>
> On Tue, Oct 8, 2024 at 4:33 PM Christopher Bongaarts via users 
> <users at shibboleth.net> wrote:
>
>     I'd like to have my MFA script select between two different Duo
>     integrations based on calculations and/or API calls happening as
>     part of
>     the MFA script (using the current DuoOIDC plugin on IdP 5.1.3).
>
>     I think a reasonable approach would be to stuff the result in the
>     AuthenticationContext, then make a
>     shibboleth.authn.DuoOIDC.DuoIntegrationStrategy bean that inspects
>     the
>     result in the AuthenticationContext and returns the appropriate Duo
>     integration.
>
>     Any caveats to this approach, or suggestions on alternatives?
>
>     -- 
>     %%  Christopher A. Bongaarts   %% cab at umn.edu         %%
>     %%  OIT - Identity Management  %% http://umn.edu/~cab %%
>     %%  University of Minnesota    %%  +1 (612) 625-1809    %%
>
>     -- 
>     For Consortium Member technical support, see
>     https://shibboleth.atlassian.net/wiki/x/ZYEpPw
>     To unsubscribe from this list send an email to
>     users-unsubscribe at shibboleth.net
>

-- 
%%  Christopher A. Bongaarts   %%cab at umn.edu          %%
%%  OIT - Identity Management  %%http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20241008/693c05fb/attachment.htm>