Multiple DuoOIDC -- Integration-Specific Principal Sets

[Cantor, Scott]

> I have learned that the order of the DuoIntegrationList is very
> important.  In the log, I can see the IDP is searching for my
> SpecialDuo integration, but it's still getting lost when doing
> SSO and sorting thru results.

The order matters because the script that derives the one to use is built in a specific way to iterate over them looking for the first match, on the assumption that you want more strict rules to be used only when necessary. If there is no order that makes sense and they won't sort of subset each other, the whole approach probably isn't applicable.

> Does anyone know of any other documentation specifically
> for the DuoOIDC version of this functionality? Or a newer
> description?

I didn't do a V5 article but there's not any difference apart from it would be a Universal Prompt one to start with. It's largely s/Duo/DuoOIDC all over the place. The Duo plugin has general docs on the multiple integration support, I don't know that anything is missing.

The REFEDS example is just a specific application of the feature that is usually similar to what people tend to do on campus.

> Did anyone run into issues/pitfalls implementing this that
> might help me? anything specific to DuoOIDC besides the
> aforementioned bug?

I don't think the bug even exists anymore, but I don't know exactly when it was fixed and it doesn't hurt anything.

There's no way to really answer this, you have to use the logs to actually determine what specifically it's doing wrong, and you never actually said. There are all sorts of general issues related to the MFA flow being defined correctly, complications like user-specific policies getting in the way. It just depends what it's actually doing, but if it's picking an existing result when it shouldn't, that means the principal set just isn't right.

Brown is a member, I would advise a support ticket so that logs can be included and a more detailed description of the problem provided.

-- Scott