<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">On 1/16/2019 3:38 PM, Cantor, Scott
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:SN6PR0102MB350242F28DFD1793E407F9EBD0820@SN6PR0102MB3502.prod.exchangelabs.com">
<blockquote type="cite" style="color: #000066;">
<pre class="moz-quote-pre" wrap="">My guess is that the duo public api is about the same amount of reliable as the
one the iframe uses. If one's gonna fail probably the other will.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">It's more to do with hanging requests in the IdP. The frame isn't the IdP calling them, it's the browser. Different failure mode. Like I said, I'm highly paranoid.</pre>
</blockquote>
<p>We did it like Jim except on 3.3 we rolled our own (read:
backported 3.4 code) HTTP client and built a
DuoEnrollmentPredicate class. We mitigate the risk somewhat by
only doing the enrollment check for a limited period of tim.
Similar to the "grace period" Stephen mentioned, we set our LDAP
flag (actually a date) to 7 days out; prior to that, we check Duo
to see if they've enrolled and enforce its use if they are. Once
the date in LDAP is reached, we always enforce Duo usage for that
user, so we no longer have to check for enrollment.</p>
<p>
</p>
<pre class="moz-signature" cols="72">--
%% Christopher A. Bongaarts %% <a class="moz-txt-link-abbreviated" href="mailto:cab@umn.edu">cab@umn.edu</a> %%
%% OIT - Identity Management %% <a class="moz-txt-link-freetext" href="http://umn.edu/~cab">http://umn.edu/~cab</a> %%
%% University of Minnesota %% +1 (612) 625-1809 %%
</pre>
</body>
</html>