<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;
mso-believe-normal-left:yes;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
span.EmailStyle17
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><![if mso 9]><style>p.MsoNormal
{margin-left:7.5pt;}
</style><![endif]><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple" style="margin-left:7.5pt;margin-top:7.5pt;margin-right:7.5pt;margin-bottom:7.5pt">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Hi Clayton,<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">You need to configure Multi Factor Authn (MFA). You probably want it to run Password Authn first and then run Duo. And of course you must configure Duo. If
the IDP is currently running Password directly, then run MFA instead.<o:p></o:p></span></p>
<div>
<p class="MsoNormal" style="margin:0in;margin-bottom:.0001pt"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Stephen C. Losen<o:p></o:p></span></p>
<p class="MsoNormal" style="margin:0in;margin-bottom:.0001pt"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">ITS - Systems and Storage<o:p></o:p></span></p>
<p class="MsoNormal" style="margin:0in;margin-bottom:.0001pt"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">University of Virginia<o:p></o:p></span></p>
<p class="MsoNormal" style="margin:0in;margin-bottom:.0001pt"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><a href="mailto:scl@virginia.edu"><span style="color:#0563C1">scl@virginia.edu</span></a> 434-924-0640<o:p></o:p></span></p>
</div>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal" style="margin:0in;margin-bottom:.0001pt"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> users [mailto:users-bounces@shibboleth.net]
<b>On Behalf Of </b>Clayton<br>
<b>Sent:</b> Friday, June 22, 2018 1:10 PM<br>
<b>To:</b> users@shibboleth.net<br>
<b>Subject:</b> Duo in Shib 3.3<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal" style="margin:0in;margin-bottom:.0001pt"><span style="font-size:14.0pt;font-family:"Calibri",sans-serif;color:black">I'm trying to setup Duo in our Shib test env.</span><o:p></o:p></p>
<p class="MsoNormal" style="margin:0in;margin-bottom:.0001pt"><o:p> </o:p></p>
<p class="MsoNormal" style="margin:0in;margin-bottom:.0001pt"><span style="font-size:14.0pt;font-family:"Calibri",sans-serif;color:black">In the simplest configuration, what triggers Shib to use its Duo client?</span><o:p></o:p></p>
<p class="MsoNormal" style="margin:0in;margin-bottom:.0001pt"><span style="font-size:14.0pt;font-family:"Calibri",sans-serif;color:black">It's probably in the </span><a href="https://wiki.shibboleth.net/confluence/display/IDP30/DuoAuthnConfiguration" target="_blank"><span style="font-size:14.0pt;font-family:"Calibri",sans-serif"> documentation
for DuoAuthnConfiguration</span></a><span style="font-size:14.0pt;font-family:"Calibri",sans-serif;color:black">, but I don't see it.</span><o:p></o:p></p>
<p class="MsoNormal" style="margin:0in;margin-bottom:.0001pt"><o:p> </o:p></p>
<p class="MsoNormal" style="margin:0in;margin-bottom:.0001pt"><span style="font-size:14.0pt;font-family:"Calibri",sans-serif;color:black">Thanks in advance,</span><o:p></o:p></p>
<p class="MsoNormal" style="margin:0in;margin-bottom:.0001pt"><span style="font-size:14.0pt;font-family:"Calibri",sans-serif;color:black">--Clayton</span><o:p></o:p></p>
</div>
</body>
</html>