Duo Forceauthn authn failure starting 2029-09-08

[Steven Teixeira]

Hi Brian,

I saw this topic recently, and the details are here: https://shibboleth.atlassian.net/browse/JDUO-102

I have not looked into this myself yet.  I just thought I’d relay what I’d seen posted elsewhere in hopes it helps.

Steven Teixeira

From: users <users-bounces at shibboleth.net> On Behalf Of Brian Rose via users
Sent: Monday, September 14, 2026 8:31 AM
To: users at shibboleth.net
Cc: Brian Rose <brose at pointnclick.com>
Subject: Duo Forceauthn authn failure starting 2029-09-08

CAUTION: This message originated from outside of Stanislaus State. Do not click on links or open attachments unless you recognize the sender and are expecting the message.

We have several Shibboleth IDP customers with Duo MFA, and since mid-day last Tuesday 2029-09-08 two of them are reporting SSO failures when the end user has an existing Shibboleth SSO session, and a login to a new SP with forceauthn is sent.
We are seeing a authnfailure sent to the SP.

2026-09-08 14:18:24 (ET)
<saml2p:Status><saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:Requester"><saml2p:StatusCode Value="urn:oasis:names:tc:SAML:2.0:status:AuthnFailed"/></saml2p:StatusCode><saml2p:StatusMessage>An error occurred.</saml2p:StatusMessage></saml2p:Status>

Does anyone know if there were any default changes published just before then? I am still working with the two IDPs that are experiencing this issue to determine if anything was installed on their IDP systems which correlate to this, and I have opened a ticket with Duo as well.


--
Brian Rose
Point and Click Solutions, Inc.
Chief Information Security Officer
916-800-2338
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20260914/194b740f/attachment.htm>