<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On May 7, 2020, at 7:43 AM, David A. Kovacic <<a href="mailto:dak@case.edu" class="">dak@case.edu</a>> wrote:</div><br class="Apple-interchange-newline"><div class="">
<meta http-equiv="content-type" content="text/html; charset=UTF-8" class="">
<div class="">
At CWRU our Information Security office is trying to deploy Duo
integration as widely as possible, and is hoping to switch the Duo
setting to require enrollment rather than giving a free pass to
those users not enrolled in Duo as it is currently configured.
Given that our alums retain access to G Suite services indefinitely
after graduation, we are forced to either purchase many more Duo
licenses, or to deploy multiple Duo integrations through our IdP. <br class="">
<br class="">
In researching the issue, we've come across
<a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/IDP">https://wiki.shibboleth.net/confluence/display/IDP</a>[3-4]/DuoAuthnConfiguration#DuoAuthnConfiguration-MultipleDuoIntegrations
which provides a script example that seems to be able to pretty much
be dropped into place with only the customization of the
duo.properties file and the URLs in the table that map to the
"special Duo". The example seems to do exactly what e need it to
do.<br class="">
<br class="">
My questions:<br class="">
<ol class="">
<li class="">Is this implementation really as straightforward as it appears
with just the customization of the URLs in the map and the
properties file, then a rebuild of the .war file, or is there
actually more involved in setting this up? None of our team is
that much of a Java programmer and we'd like to avoid writing
custom Java code if it can be avoided.</li>
<li class="">Has anyone implemented multiple Duo integrations using
something similar to the script example provided? If so did you
face any challenges, and what were they?</li>
</ol><p class="">We are currently running IdP 3, but are in the process of
upgrading to IdP 4 but the integration seems to be exactly the
same across both versions</p></div></div></blockquote></div>It does "just work". Don't need it often, but we know an organization using that exact approach to map to 3 different Duo integrations. And there is no need to rebuild the WAR file, you aren't touching anything that has to do with WAR file; you just need to restart the IdP.<div class=""><br class=""></div><div class="">Another way to handle your use case is to stick with a single Duo integration, but have logic in mfa-authn-config based on user affiliation attribute(s), and simply don't require Duo (don't send the user to Duo) if the user is alumni. We've seen that also.</div><div class=""><br class=""><div class="">
<div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;">--<br class="">Michael A. Grady<br class="">IAM Architect, Unicon, Inc.</div><div style="color: rgb(0, 0, 0); font-family: Helvetica; font-size: 14px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; orphans: auto; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: auto; word-spacing: 0px; -webkit-text-size-adjust: auto; -webkit-text-stroke-width: 0px;" class=""><br class=""></div><br class="Apple-interchange-newline">
</div>
<br class=""></div></body></html>