<div dir="ltr"><div class="gmail_quote"><div dir="ltr">On Thu, Jul 20, 2017 at 3:09 PM Mak, David <<a href="mailto:d.mak@northeastern.edu">d.mak@northeastern.edu</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">







<div bgcolor="white" lang="EN-US" link="blue" vlink="purple">
<div class="m_-2504871236752100328WordSection1">
<p class="MsoNormal"><span style="font-family:Calibri,sans-serif;font-size:11pt">We’ve got our banner services integrated using the native CAS implementation and would like to add Duo MFA</span><br></p></div></div></blockquote><div><br></div><div>You can absolutely do this. We rely on the ability to switch authentication methods based on CAS protocol details and it works as you seem to expect.</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div bgcolor="white" lang="EN-US" link="blue" vlink="purple"><div class="m_-2504871236752100328WordSection1"><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">our relying party setup, which looks like this:</span> </p></div></div></blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div bgcolor="white" lang="EN-US" link="blue" vlink="purple"><div class="m_-2504871236752100328WordSection1"><p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"><u></u> <u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">        <bean parent="RelyingPartyByGroup" c:groupNames="banner-services"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">                <property name="profileConfigurations"><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">                        <list><u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">                                <bean parent="CAS.LoginConfiguration" p:defaultAuthenticationMethods="<a href="http://www.duosecurity.com/" target="_blank">http://www.duosecurity.com/</a>" /></span></p></div></div></blockquote><div><br></div><div>I have no experience with the Unicon plugins, but the general approach of customizing profile configurations here based on a group name is the key feature, and it works like you expect.</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div bgcolor="white" lang="EN-US" link="blue" vlink="purple"><div class="m_-2504871236752100328WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">And is matched to the CAS service registry config that looks like this:</span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">                <bean class="net.shibboleth.idp.cas.service.ServiceDefinition"<u></u><u></u></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">                      c:regex="https:\/\/ourbannerhost.*\.neu\.edu(:\d+)?\/.*"</span></p></div></div></blockquote><div><br></div><div>The regular expression looks suspect. First, you don't have to escape forward slashes and, second, wildcarding is dangerous. If you're trying to say "any subdomain containing this host in our domain", then here's how you could safely say that:</div><div><br></div><div><a href="https://ourbannerhost(.[A-Za-z_-]+)*\.neu\.edu(:\d+)?\/.*">https://ourbannerhost(\.[A-Za-z_-]+)*\.neu\.edu(:\d+)?\/.*</a></div><div><br></div><div>M</div><div><br></div></div></div>