DuoOIDC passwordless event handling question

[Scott Cantor]

> On Mar 11, 2026, at 4:47 PM, Steven Premeau via users <users at shibboleth.net> wrote:
> 
> That said, the exit status of the DuoPlugin will only be based on the Duo authentication.   If you wanted (or needed) to check some additional items after that Authentication stage completes and before things are finalized, you would need to define another step linked to the "proceed" event.

That's what I meant, the MFA flow won't "guard" it. If you tell it to run a flow, it doesn't care if that flow is or isn't "suitable", it just does it. If the result ultimately isn't what's needed, the failure happens at the very end.

> I'll defer to Scotts answer on whether it's better to remove the requirement from the SP or try to deal with it on the IDP.... 

Well, as a matter of the standard, you don't have a choice. You can fix the SP or lie. PPT is obviously not what the passwordless flow is doing.

You don't have the leeway to say "but it's better", unless the SP specifies "better" or "minimum" as an operator and not "exact".

If I were planning to violate the standard, though, I wouldn't lie, I'd add PPT to the list of "ignored" AuthnContext classes. By doing that, the IdP will treat it like "unspecified" and simply not even acknowledge that there was a request made with anything specific.

The response is therefore non-compliant, but a broken SP ain't gonna notice.

But that is all or nothing, it's a global setting.

-- Scott