Selecting Duo integration during MFA script

[Christopher Bongaarts]

On 10/8/2024 4:28 PM, Steven Premeau wrote:
> I would still advocate for doing the minimum required (e.g. a single 
> Duo API call) within the MFA script and the rest of the logic in 
> DuoIntegrationStrategy -- I have found it cleaner to keep Duo details 
> within the Duo configuration files.
>
> Although the risk is greater within the DuoPasswordless scenarios, 
> depending on the percentage of sessions that will make an API call and 
> NOT activate Duo, you may want to utilize a local resource prior to 
> (or in place of) the API call....  with the local resources you are in 
> control of the request limits -- what would your planned approach do 
> if (when) Duo returns a 429 "Try again later" response?

In fact, we do have a local resource (LDAP attribute) that has been then 
main determinant so far (it's a date field with slightly different 
behavior depending on how close the But Thou Must kicks in), and the API 
is checked to see if they are enrolled and so they Must use it now.  To 
me, this logic really does belong in the MFA config rather than the Duo 
config, in the sense of it controlling whether to attempt the second 
factor or not.

The new strategy is needed to direct them to a separate integration to 
minimize the number of students setting up a single platform 
authenticator and then not bringing it with them to school, which was an 
unfortunate consequence of moving to the Universal Prompt earlier this 
year.  This aspect feels like it should belong more in the Duo config as 
you suggest, and while the API check is still happening in the MFA 
script, the actual integration is selected in the Duo config.

On the upside, getting this going really didn't need too much change - 
just a few beans in the Duo config and a few new lines in the MFA script.

-- 
%%  Christopher A. Bongaarts   %%  cab at umn.edu          %%
%%  OIT - Identity Management  %%  http://umn.edu/~cab  %%
%%  University of Minnesota    %%  +1 (612) 625-1809    %%