<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
On 9/11/2018 6:22 PM, Cantor, Scott wrote:<br>
<blockquote type="cite"
cite="mid:SN6PR0102MB3502B514B7626AAC0F9BD087D0040@SN6PR0102MB3502.prod.exchangelabs.com">
<blockquote type="cite" style="color: #000066;">
<pre wrap="">Is there something in the profile configuration we could set/change to only do
the password auth half?
</pre>
</blockquote>
<pre wrap="">It really depends how you're handling it to start with. I don't have MFA imposed for all apps, and our mobile app doesn't request or require MFA, so it doesn't think it should run Duo, and all is well.</pre>
</blockquote>
<br>
The MFA logic we're using boils down to (simplified slightly):<br>
Run password first, then:<br>
If SP requests Duo, run Duo.<br>
If user's LDAP entry indicates they are required to use Duo, run
Duo.<br>
If user's LDAP entry indicates they have opted in to use Duo, run
Duo.<br>
Else be done.<br>
<br>
My thought was we'd add a check up top to skip Duo if profile is
ECP.<br>
<br>
<blockquote type="cite"
cite="mid:SN6PR0102MB3502B514B7626AAC0F9BD087D0040@SN6PR0102MB3502.prod.exchangelabs.com">
<pre wrap="">
</pre>
<blockquote type="cite" style="color: #000066;">
<pre wrap="">Should our MFA "next-step" script check for what profile is in use and signal
"done" when the profile is ECP? (e.g. using
profileRequestContext.getProfileId(), and matching it against...
whatever the ECP ID is?)
</pre>
</blockquote>
<pre wrap="">You could if you have to for some reason, or more easily just test the isBrowserProfile method on ProfileRequestContext.
</pre>
</blockquote>
<br>
That sounds like the best way to catch this requirement, since the
PRC is already avaiable to the MFA script.<br>
<br>
<blockquote type="cite"
cite="mid:SN6PR0102MB3502B514B7626AAC0F9BD087D0040@SN6PR0102MB3502.prod.exchangelabs.com">
<pre wrap="">(Also, the non-browser Duo support is coming in 3.4, which I imagine you know.)</pre>
</blockquote>
<br>
I don't think I can squeeze that in our Duo project deadlines, but
I'll look forward to being able to drop this check in the future.<br>
<pre class="moz-signature" cols="72">--
%% Christopher A. Bongaarts %% <a class="moz-txt-link-abbreviated" href="mailto:cab@umn.edu">cab@umn.edu</a> %%
%% OIT - Identity Management %% <a class="moz-txt-link-freetext" href="http://umn.edu/~cab">http://umn.edu/~cab</a> %%
%% University of Minnesota %% +1 (612) 625-1809 %%
</pre>
</body>
</html>