<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
Hello,
<div class=""><br class="">
</div>
<div class="">We have configured DUO in IDP 3 using the instruction in wiki</div>
<div class=""><a href="https://wiki.shibboleth.net/confluence/pages/viewpage.action?pageId=20807829" class="">https://wiki.shibboleth.net/confluence/pages/viewpage.action?pageId=20807829</a></div>
<div class=""><br class="">
</div>
<div class="">Everything works fine except force authentication. When SP requested forceAuthn=true, user was only prompted for DUO login, not password login. If I disabled DUO in IDP, then password login was prompted. According to the configuration in wiki,
when foceAuth is requested 2 minutes after IDP session, authn/Password flow should be used. But I didn’t see this happened.</div>
<div class=""><br class="">
</div>
<div class="">It seems the configuration defined in flows/Duo/duo-authn-flow.xml is not being used. Is there anything I have to define in IDP to make this xml get executed?</div>
<div class=""><br class="">
</div>
<div class="">
<div class="number7 alt2 line index6"><code class="xml spaces"> </code><code class="xml comments"><!-- if the IdP session is < 2 minutes then don't check for forceAuthn. If it's more than that</code></div>
<div class="index7 line number8 alt1"><code class="xml spaces"> </code><code class="xml comments">then check for forceAuthn and if forceAuthn is in play make the user do a 2nd Password login.</code></div>
<div class="alt2 line index8 number9"><code class="xml spaces"> </code><code class="xml comments">This eliminates the problem we had with a user hitting a forceAuthn site as their first SP & then</code></div>
<div class="number10 line index9 alt1"><code class="xml spaces"> </code><code class="xml comments">having to double-enter their username/password.</code></div>
<div class="index10 line alt2 number11"><code class="xml spaces"> </code><code class="xml comments">--></code></div>
<div class="line number12 index11 alt1"><code class="xml spaces"> </code><code class="xml plain"><</code><code class="xml keyword">decision-state</code>
<code class="xml color1">id</code><code class="xml plain">=</code><code class="xml string">"checkFirstLogin"</code><code class="xml plain">></code></div>
<div class="index12 alt2 line number13"><code class="xml spaces"> </code><code class="xml plain"><</code><code class="xml keyword">if</code>
<code class="xml plain">test="(currentTime.getTime() - opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.session.context.SessionContext)).getIdPSession().getCreationInstant()) > 120000"</code></div>
<div class="number14 line index13 alt1"><code class="xml spaces"> </code><code class="xml plain">then="checkForceAuth"</code></div>
<div class="alt2 line number15 index14"><code class="xml spaces"> </code><code class="xml plain">else="duo" />
</code></div>
<div class="line number16 index15 alt1"><code class="xml spaces"> </code><code class="xml plain"></</code><code class="xml keyword">decision-state</code><code class="xml plain">></code></div>
<div class="number17 line alt2 index16"><code class="xml spaces"> </code><code class="xml plain"><</code><code class="xml keyword">decision-state</code>
<code class="xml color1">id</code><code class="xml plain">=</code><code class="xml string">"checkForceAuth"</code><code class="xml plain">></code></div>
<div class="index17 line alt1 number18"><code class="xml spaces"> </code><code class="xml plain"><</code><code class="xml keyword">if</code>
<code class="xml color1">test</code><code class="xml plain">=</code><code class="xml string">"opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.AuthenticationContext)).isForceAuthn()"</code></div>
<div class="alt2 line number19 index18"><code class="xml spaces"> </code><code class="xml color1">then</code><code class="xml plain">=</code><code class="xml string">"CallPasswordFlow"</code></div>
<div class="index19 line number20 alt1"><code class="xml spaces"> </code><code class="xml color1">else</code><code class="xml plain">=</code><code class="xml string">"duo"</code>
<code class="xml plain">/></code></div>
<div class="alt2 line number21 index20"><code class="xml spaces"> </code><code class="xml plain"></</code><code class="xml keyword">decision-state</code><code class="xml plain">></code></div>
<div class="number22 line index21 alt1"><code class="xml spaces"> </code><code class="xml plain"><</code><code class="xml keyword">subflow-state</code>
<code class="xml color1">id</code><code class="xml plain">=</code><code class="xml string">"CallPasswordFlow"</code>
<code class="xml color1">subflow</code><code class="xml plain">=</code><code class="xml string">"authn/Password"</code><code class="xml plain">></code></div>
<div class="index22 line alt2 number23"><code class="xml spaces"> </code><code class="xml plain"><</code><code class="xml keyword">input</code>
<code class="xml color1">name</code><code class="xml plain">=</code><code class="xml string">"calledAsSubflow"</code>
<code class="xml color1">value</code><code class="xml plain">=</code><code class="xml string">"true"</code><code class="xml plain">/></code></div>
<div class="line number24 index23 alt1"><code class="xml spaces"> </code><code class="xml plain"><</code><code class="xml keyword">transition</code>
<code class="xml color1">on</code><code class="xml plain">=</code><code class="xml string">"proceed"</code>
<code class="xml color1">to</code><code class="xml plain">=</code><code class="xml string">"duo"</code><code class="xml plain">/></code></div>
<div class="index24 alt2 line number25"><code class="xml spaces"> </code><code class="xml plain"></</code><code class="xml keyword">subflow-state</code><code class="xml plain">></code></div>
<div class=""><br class="">
</div>
<div class="">Thanks,</div>
<div class=""><br class="">
</div>
<div apple-content-edited="true" class="">
<div class="">
<div style="orphans: 2; widows: 2;" class="">Hong</div>
</div>
</div>
</div>
</body>
</html>