<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
At CWRU our Information Security office is trying to deploy Duo
integration as widely as possible, and is hoping to switch the Duo
setting to require enrollment rather than giving a free pass to
those users not enrolled in Duo as it is currently configured.
Given that our alums retain access to G Suite services indefinitely
after graduation, we are forced to either purchase many more Duo
licenses, or to deploy multiple Duo integrations through our IdP. <br>
<br>
In researching the issue, we've come across
<a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/IDP">https://wiki.shibboleth.net/confluence/display/IDP</a>[3-4]/DuoAuthnConfiguration#DuoAuthnConfiguration-MultipleDuoIntegrations
which provides a script example that seems to be able to pretty much
be dropped into place with only the customization of the
duo.properties file and the URLs in the table that map to the
"special Duo". The example seems to do exactly what e need it to
do.<br>
<br>
My questions:<br>
<ol>
<li>Is this implementation really as straightforward as it appears
with just the customization of the URLs in the map and the
properties file, then a rebuild of the .war file, or is there
actually more involved in setting this up? None of our team is
that much of a Java programmer and we'd like to avoid writing
custom Java code if it can be avoided.</li>
<li>Has anyone implemented multiple Duo integrations using
something similar to the script example provided? If so did you
face any challenges, and what were they?</li>
</ol>
<p>We are currently running IdP 3, but are in the process of
upgrading to IdP 4 but the integration seems to be exactly the
same across both versions.</p>
<p><br>
</p>
<p>Thanks,</p>
<p>Dave<br>
</p>
</body>
</html>