<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
Hi Joe and/or Scott.
<div class=""><br class="">
</div>
<div class="">I’m trying to get Duo working on a clean Shibboleth IdP 3.3 install (in a development environment for now) and am stumped as to why the IdP isn’t sending me to the duo web flow after successful authentication. I’m hoping you can provide a missing
link that I’m obviously missing somewhere.</div>
<div class=""><br class="">
</div>
<div class="">Here’s a summary of the files I’ve edited in the /opt/shibboleth-idp/conf directory.</div>
<div class=""><br class="">
</div>
<div class="">——</div>
<div class="">attribute-filter.xml (to enable SSO testing)</div>
<div class="">attribute-resolver.xml (“ “ ")</div>
<div class="">metadata-providers.xml (“ “ “)</div>
<div class="">relying-party.xml (“ “ “)</div>
<div class=""><br class="">
</div>
<div class="">logback.xml (Modified to enable DEBUG level logging for most logging).</div>
<div class=""><br class="">
</div>
<div class="">idp.properties (typical install changes for entityID and scope plus…)</div>
<div class=""><span class="Apple-tab-span" style="white-space:pre"></span>modified property to idp.authn.flows = Password|Duo|MFA</div>
<div class=""><span class="Apple-tab-span" style="white-space:pre"></span>modified properties to enable SLO.</div>
<div class=""><span class="Apple-tab-span" style="white-space:pre"></span>ensured that idp.additionalProperties includes /conf/authn/duo.properties</div>
<div class=""><br class="">
</div>
<div class="">ldap.properties (typical install changes for authenticated attribute resolution)</div>
<div class=""><br class="">
</div>
<div class="">authn/duo.properties</div>
<div class=""><span class="Apple-tab-span" style="white-space:pre"></span>modified properties idp.duo.apiHost, idp.udo.applicationKey, idp.duo.integrationKey, and idp.duo.secretKey to match those provided in the Duo admin web console.</div>
<div class=""><br class="">
</div>
<div class="">authn/general-authn.xml</div>
<div class=""><span class="Apple-tab-span" style="white-space:pre"></span>replaced c:classRef="<a href="http://example.org/ac/classes/mfa" class="">http://example.org/ac/classes/mfa</a>" /> with c:classRef="<a href="http://id.incommon.org/assurance/mfa" class="">http://id.incommon.org/assurance/mfa</a>"
/></div>
<div class=""><span class="Apple-tab-span" style="white-space:pre"></span>replaced c:method="<a href="http://example.org/ac/classes/mfa" class="">http://example.org/ac/classes/mfa</a>" /> with c:method="<a href="http://id.incommon.org/assurance/mfa" class="">http://id.incommon.org/assurance/mfa</a>"
/></div>
<div class=""><br class="">
</div>
<div class="">authn/jaas.config (Modified to work with our multiple AD LDAP proxies)</div>
<div class=""><br class="">
</div>
<div class="">authn/mfa-authn-config.xml (Made all the modifications Scott described in his previous message in this thread).</div>
<div class=""><br class="">
</div>
<div class="">authn/password-authn-config.xml</div>
<div class=""><span class="Apple-tab-span" style="white-space:pre"></span>uncommented <import resource="jaas-authn-config.xml" /></div>
<div class=""><span class="Apple-tab-span" style="white-space:pre"></span>commented out <import resource="ldap-authn-config.xml" /></div>
<div class="">——</div>
<div class=""><br class="">
</div>
<div class="">Authentication works, and after successful authentication, I’m presented with the attribute release consent form. Consenting to the release correctly redirects to the SP and passes the SAML response. SSO succeeds. However, I’m never presented
with a Duo authentication request. Logs don’t show any Duo flow activity other than upon initial Shibboleth IdP startup indicating that the flow is registered.</div>
<div class=""><br class="">
</div>
<div class="">Is something needed in the duo-authn-config.xml file? I didn’t see any documentation that specifically said that needed to be edited in order to enable it unless you wanted custom conditions (which I don’t, yet anyway).</div>
<div class=""><br class="">
</div>
<div class="">Regards,</div>
<div class="">Nathan</div>
<div class="">
<div class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div style="color: rgb(0, 0, 0); letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">
<div class="">----</div>
<div class="">Nathan Sheldon</div>
<div class="">IAM Support Engineer<br class="">
Identity and Access Management,</div>
<div class=""> Information Technology Services</div>
<div class="">University of California, San Francisco</div>
<div class=""><br class="">
</div>
</div>
</div>
<br class="Apple-interchange-newline">
</div>
<br class="Apple-interchange-newline">
<br class="Apple-interchange-newline">
</div>
<br class="">
</div>
</body>
</html>