<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<style>body{font-family:Helvetica,Arial;font-size:13px}</style>
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;">
<div id="bloop_customfont" style="font-family:Helvetica,Arial;font-size:13px; color: rgba(0,0,0,1.0); margin: 0px; line-height: auto;">
On March 24, 2016 at 9:27:03 AM, Cantor, Scott (<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>) wrote:</div>
<div>
<blockquote type="cite" class="clean_bq" style="font-family: Helvetica, Arial; font-size: 13px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;">
<span>
<div>
<div></div>
<div>> Are we discussing "trusted networks" in the Enterprise Edition or the<span class="Apple-converted-space"> </span><br>
> advance geo-location features in the Platform Edition?<span class="Apple-converted-space"> </span><br>
<br>
Trusted networks primarily, as well as time based bypass (the latter moreso really, but in the end it's all of a piece).<span class="Apple-converted-space"> </span><br>
<br>
> Using trusted networks is a policy decision that states being on that network<span class="Apple-converted-space"> </span><br>
> satisfies MFA. Whether this is good or bad policy is up for debate.<span class="Apple-converted-space"> </span><br>
<br>
I'm not asking people to agree it's bad policy, I'm asking for a third option that allows Duo to work any way it's told to but for the IdP to get enough information to accurately reflect the outcome if I don't happen to think that those are equivalent outcomes.
I don't think everybody will agree. As far as I'm able to tell, the tenor of the InCommon discussion has been that it's not equivalent, but that remains to be seen I guess.<span class="Apple-converted-space"> </span><br>
<br>
When you hand off with a frame like that, you are giving up a great deal of control and it's really important that you don't also give up visibility into the outcome.<span class="Apple-converted-space"> </span></div>
</div>
</span></blockquote>
</div>
<p>I agree it would be nice if the webSDK would tell you how the user "performed" the second factor (push, phone, sms, U2F, token, bypass, trusted device, trusted network) so the application could at least make an informed choice about what to do with the user.
You could, however, flip this request around and setup multiple Duo webSDK integrations with your IdP. That way you could have a context for "anything duo supports" vs one for "anything except phone, trusted devices, and trusted networks". You'd then have
the information you needed about what the user did (or didn't do) when they performed the additional factor.</p>
<p>Dave</p>
</body>
</html>