Selecting Duo integration during MFA script

[Steven Premeau]

Fair enough, that detail certainly impacts things.

I would still advocate for doing the minimum required (e.g. a single Duo
API call) within the MFA script and the rest of the logic in
DuoIntegrationStrategy -- I have found it cleaner to keep Duo details
within the Duo configuration files.

Although the risk is greater within the DuoPasswordless scenarios,
depending on the percentage of sessions that will make an API call and NOT
activate Duo, you may want to utilize a local resource prior to (or in
place of) the API call....  with the local resources you are in control of
the request limits -- what would your planned approach do if (when) Duo
returns a 429 "Try again later" response?

Steve.

On Tue, Oct 8, 2024 at 5:14 PM Christopher Bongaarts via users <
users at shibboleth.net> wrote:

> A good suggestion, but there is a Duo API call that needs to happen in the
> MFA script to decide whether to invoke the Duo auth in the first place that
> I would prefer not to have to duplicate within the integration strategy...
>
> On 10/8/2024 4:10 PM, Steven Premeau wrote:
>
> Chris -
>
>   If the MFA flow is "always" going to select a Duo integration, it might
> make more sense to perform the calculations and API calls within
> the DuoIntegrationStrategy bean.  (I believe everything you would be
> looking at via the MFA script is also available in DuoIntegrationStrategy.)
>
>   Stuffing the results would certainly work, but might be overkill if they
> are only going to be used once after calculation and not have any other
> "long term" value.
>
> Steve.
>
> On Tue, Oct 8, 2024 at 4:33 PM Christopher Bongaarts via users <
> users at shibboleth.net> wrote:
>
>> I'd like to have my MFA script select between two different Duo
>> integrations based on calculations and/or API calls happening as part of
>> the MFA script (using the current DuoOIDC plugin on IdP 5.1.3).
>>
>> I think a reasonable approach would be to stuff the result in the
>> AuthenticationContext, then make a
>> shibboleth.authn.DuoOIDC.DuoIntegrationStrategy bean that inspects the
>> result in the AuthenticationContext and returns the appropriate Duo
>> integration.
>>
>> Any caveats to this approach, or suggestions on alternatives?
>>
>> --
>> %%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
>> %%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
>> %%  University of Minnesota    %%  +1 (612) 625-1809    %%
>>
>> --
>> For Consortium Member technical support, see
>> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
>> To unsubscribe from this list send an email to
>> users-unsubscribe at shibboleth.net
>>
>
> --
> %%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
> %%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
> %%  University of Minnesota    %%  +1 (612) 625-1809    %%
>
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20241008/72c00c2d/attachment.htm>