<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
On Aug 20, 2014, at 6:14 PM, Wessel, Keith <<a href="mailto:kwessel@illinois.edu">kwessel@illinois.edu</a>> wrote:<br>
<div><br class="Apple-interchange-newline">
<blockquote type="cite">
<div style="margin: 0in 0in 0.0001pt; font-size: 12pt; font-family: 'Times New Roman', serif; font-style: normal; font-variant: normal; font-weight: normal; letter-spacing: normal; line-height: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<span style="font-size: 11pt; font-family: Calibri, sans-serif; color: rgb(31, 73, 125);">Unfortunately, 1.1.4 doesn’t seem to act any differently for me. Same result going straight to the SP configured to ask for both, and same behavior going to the other
SP configured for nothing specific first then the specially configured SP. It’s never asking for Duo.<o:p></o:p></span></div>
<br class="Apple-interchange-newline">
</blockquote>
</div>
<div><br>
</div>
<div>Keith,</div>
<div><br>
</div>
<div>How do you have your MCB config setup? It sounds like both password and duo end up being equal. I'm thinking you will need something like this:</div>
<div><br>
</div>
<div><context name="password" method="password"></div>
<div><span class="Apple-tab-span" style="white-space:pre"></span><allowedContexts>duo</allowedContexts></div>
<div></context></div>
<div><br>
</div>
<div><context name="duo" method="duo" /></div>
<div><br>
</div>
<div>So Duo is allowed to be used for password, but password is not allowed for Duo. Then, if you are wanting to force Duo, have the SP send only Duo. If the SP sends both password and Duo, then while one may be preferred by the order given, it still means
both are acceptable.</div>
<div><br>
</div>
<div>Where the greater control comes in is to limit the user to only Duo. So you can say this user is only allowed Duo while the SP can allow either choice.</div>
<div><br>
</div>
<div>Paul</div>
<div><br>
</div>
<br>
<div apple-content-edited="true">Paul Hethmon<br>
Chief Software Architect<br>
<a href="mailto:paul.hethmon@clareitysecurity.com">paul.hethmon@clareitysecurity.com</a><br>
<br>
</div>
<br>
</body>
</html>