DuoOIDC passwordless event handling question

[Steven Premeau]

Steven -

  I know that those examples worked when the Passwordless support was
released, but it's difficult to debug with the partial configuration.

The error you are reporting is occurring after the MFA flow has completed,
do you have any (debug) logging that offers up status as the MFA is
working?

Of note, if the request is including a specific authentication type, it
could be that everything is working as you expect, but the end result does
not satisfy that requirement.....

Steve.




On Wed, Mar 11, 2026 at 3:20 PM Mak, Steven via users <users at shibboleth.net>
wrote:

> Hello all,
>
> In the DuoOIDCPasswordless configuration page there is an example movie
> where the user is returned to a password prompt screen if the factors are
> deemed unacceptable. I've read over the "Event Handling" section of the
> document several times. I've configured my mfa-authn-config.xml file to
> watch for these events in the authn/DuoOIDC nextFlowStrategy Map, but my
> IdP only seems to stop trying once it hits a RequestUnsupported result,
> instead of proceeding to the script ref I provide.
>
> Does anyone have an example of how these event handlers are supposed to be
> wired up?
>
> Profile Action FinalizeAuthentication: Authentication result for flow
> authn/MFA did not satisfy the request
> A non-proceed event occurred while processing the request:
> RequestUnsupported
>
> Am I missing some documentation on how to transition to from this event to
> my script? My checkFirstFactor clears the duoContext and sends the user to
> authn/Password just like the documented example, but it doesn't work.
>
> Here's the nextFlowStrategyMap I have:
>
>         <entry key="authn/DuoOIDC">
>             <bean parent="shibboleth.authn.MFA.Transition">
>                 <property name="nextFlowStrategyMap">
>                     <map>
>                         <entry key="RequestUnsupported"
> value-ref="checkFirstFactor"/>
>                         <entry key="ReselectFlow"
> value-ref="checkFirstFactor"/>
>                         <entry key="IdentitySwitch"
> value-ref="checkFirstFactor"/>
>                         <entry key="InvalidCredentials"
> value-ref="checkFirstFactor"/>
>                     </map>
>                 </property>
>             </bean>
>         </entry>
>
>
>
> https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/3360686194/DuoOIDCPasswordless
> --
> For Consortium Member technical support, see
> https://shibboleth.atlassian.net/wiki/x/ZYEpPw
> To unsubscribe from this list send an email to
> users-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260311/d494d6ce/attachment.htm>