<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<style type="text/css" style="display:none;"><!-- P {margin-top:0;margin-bottom:0;} --></style>
</head>
<body dir="ltr">
<div id="divtagdefaultwrapper" style="font-size:12pt;color:#000000;font-family:Calibri,Arial,Helvetica,sans-serif;" dir="ltr">
<p><span style="font-family: Calibri, sans-serif; font-size: 15px;">We are wondering if anyone else has implemented Duo/MFA to be triggered only on un-trusted networks. We realize we can use Duo's built in Trusted Networks but that still leaves a dependence
on Duo services being available even on trusted networks. Ultimately we would want Duo to be triggered off campus and completely bypassed when on-campus.</span></p>
<p><span style="font-family: Calibri, sans-serif; font-size: 15px;"><br>
</span></p>
<p><span style="font-family: Calibri, sans-serif; font-size: 15px;">We upgraded to Shib 3.3 in our dev environment and are using the built in Duo integration. There seems to be flexible options on when to trigger MFA, especially editing the mfa-authn-config.xml
but we are running into issues. Specifically if the SP is requesting an MFA authentication by specifying an authnContextClassRef, should we allow the IDP to lie to the SP that the context was satisfied?</span></p>
<p><span style="font-family: Calibri, sans-serif; font-size: 15px;"><br>
</span></p>
<p><span style="font-family: Calibri, sans-serif; font-size: 15px;">Alternatively, we could leave SPs requesting nothing additional in their authnContextClassRef and have the IDP determine when an MFA auth is required; is that safe and scalable? </span></p>
<p><span style="font-family: Calibri, sans-serif; font-size: 15px;"><br>
</span></p>
<p><span style="font-family: Calibri, sans-serif; font-size: 15px;">We keep testing configurations but seem to run into roadblocks and want to make sure that we are not misappropriating what the new MFA strategy flow was designed to do and also not just misunderstanding
the configuration options.</span><br>
</p>
<p><br>
</p>
<p><br>
</p>
<div id="Signature">
<div id="divtagdefaultwrapper" dir="ltr" style="font-size:12pt; color:#000000; font-family:Calibri,Arial,Helvetica,sans-serif">
<p></p>
<p class="MsoNormal"><b><span style="font-size:7.5pt; font-family:"Arial","sans-serif"; color:#1F497D">Paul Mulchek </span></b><span style="font-size:7.5pt; font-family:"Arial","sans-serif"; color:#1F497D">|
<b>Systems Engineer IV | Enterprise Engineering | Washington University in St. Louis</b><br>
</span></p>
<br>
<p></p>
</div>
</div>
</div>
</body>
</html>