<html><head><meta http-equiv="Content-Type" content="text/html charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class=""><br class=""><div><blockquote type="cite" class=""><div class="">On Jan 18, 2017, at 3:16 PM, Jim Fox <<a href="mailto:fox@washington.edu" class="">fox@washington.edu</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><br style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">We have something related at UW. We have an SP that requests Password authn, but for certain users (identified by group membership) they want us to require Duo as well. I have no control over this requirement.</span><br style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">My solution was to replicate MFA, into 'wdmfa' (that's easier than you'd think) and assign 'wdmfa' to that SP. Essentially they get their own 'Password'.</span><br style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">Jim</span><br style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><span style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px; float: none; display: inline !important;" class="">On Wed, 18 Jan 2017, Cantor, Scott wrote:</span><br style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><br style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-stroke-width: 0px;" class=""><blockquote type="cite" style="font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class="">Date: Wed, 18 Jan 2017 13:08:24<br class="">From: "Cantor, Scott" <<a href="mailto:cantor.2@osu.edu" class="">cantor.2@osu.edu</a>><br class="">To: Shib Users <<a href="mailto:users@shibboleth.net" class="">users@shibboleth.net</a>><br class="">Reply-To: Shib Users <<a href="mailto:users@shibboleth.net" class="">users@shibboleth.net</a>><br class="">Subject: Re: MFA result reuse with Duo.<br class="">On 1/18/17, 3:56 PM, "users on behalf of O'Dowd, Josh" <<a href="mailto:users-bounces@shibboleth.net" class="">users-bounces@shibboleth.net</a> on behalf of <a href="mailto:Josh.O'Dowd@mso.umt.edu" class="">Josh.O'Dowd@mso.umt.edu</a>> wrote:<br class=""><br class=""><blockquote type="cite" class="">Yes, sorry, at the time, we were very early in talks with Duo and getting Demo set up. At that time I didn't have the<br class="">current requirements that I am trying to satisfy today. We are still in the demo/decision stages with Duo but they are<br class="">getting close to a commitment, so I am getting a clearer picture of our initial use case.<br class=""></blockquote><br class="">It's not like the use case is novel but not having it in front of me to work through I didn't realize there was a gap. I don't know how best to solve at this stage, but I think it boils down to more control over reuse/SSO.<br class=""><br class="">Right now SSO is linked to remembering previous results, but if the system tracked the results but didn't impose its own reuse logic, that might work. Even a basic "SSO or not" flag independent of the enabling of the session layer might be enough to solve it.<br class=""><br class="">-- Scott<br class=""></blockquote></div></blockquote></div><div class=""><br class=""></div><div class=""><br class=""></div>We had a client that wanted an example attribute-resolver script, for populating the "user attribute as to which flows apply" that you could use with our 3.x Duo plugin pre- 3.3, that would illustrate handling all the following use cases:<div class=""><br class="">1.<span class="Apple-tab-span" style="white-space: pre;"> </span>Require Duo login for opt-in users [i] logging into the IdP (i.e., any SP).<br class="">2.<span class="Apple-tab-span" style="white-space: pre;"> </span>Require Duo login for all users logging into specific SPs.<br class="">3.<span class="Apple-tab-span" style="white-space: pre;"> </span>Require Duo login only for a certain user population [ii] logging into specific SPs.<br class="">4.<span class="Apple-tab-span" style="white-space: pre;"> </span>Require Duo login only for opt-in users [i] when logging into specific SPs.<br class="">5.<span class="Apple-tab-span" style="white-space: pre;"> </span>Opt-out [i] certain users from Use Case #3.</div><div class=""><br class=""></div><div class="">I had sent that to the Shib Users list, along with the sample resolver script, back in April 2016. I don't know that this client actually ended up actually implementing all these use cases. Didn't think to resend that list as comments for the 3.3 development. Not sure if you want to worry about all those, but certainly there are folks thinking about having those use cases.</div><div class=""><br class=""><div class="">
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;">--<br class="">Michael A. Grady<br class="">IAM Architect, Unicon, Inc.</div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><br class="Apple-interchange-newline">
</div>
<br class=""></div></body></html>