<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Menlo;
panose-1:0 0 0 0 0 0 0 0 0 0;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman",serif;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D">Thank you David & Scott.<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-size:11.0pt;font-family:"Calibri",sans-serif;color:#1F497D"><o:p> </o:p></span></p>
<div>
<div style="border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in 0in 0in">
<p class="MsoNormal"><b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif">From:</span></b><span style="font-size:11.0pt;font-family:"Calibri",sans-serif"> users <users-bounces@shibboleth.net>
<b>On Behalf Of </b>IAM David Bantz<br>
<b>Sent:</b> Tuesday, July 13, 2021 3:46 PM<br>
<b>To:</b> Shib Users <users@shibboleth.net><br>
<b>Subject:</b> Re: MFA - Duo Configuration issue<o:p></o:p></span></p>
</div>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">FYI, that flag to support ForceAuthn is in:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">…conf/<span style="font-size:8.5pt;font-family:"Menlo",serif">authn/general-authn.xml</span><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p style="margin:0in;margin-bottom:.0001pt;font-stretch:normal"><span style="font-size:8.5pt;font-family:"Menlo",serif;color:black"> </span><span style="font-size:8.5pt;font-family:"Menlo",serif;color:#2EAEBB"><bean
</span><span style="font-size:8.5pt;font-family:"Menlo",serif;color:#2FB41D">id</span><span style="font-size:8.5pt;font-family:"Menlo",serif;color:black">=</span><span style="font-size:8.5pt;font-family:"Menlo",serif;color:#B42419">"authn/Duo"</span><span style="font-size:8.5pt;font-family:"Menlo",serif;color:#2EAEBB">
</span><span style="font-size:8.5pt;font-family:"Menlo",serif;color:#2FB41D">parent</span><span style="font-size:8.5pt;font-family:"Menlo",serif;color:black">=</span><span style="font-size:8.5pt;font-family:"Menlo",serif;color:#B42419">"shibboleth.AuthenticationFlow"<o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;font-stretch:normal"><span style="font-size:8.5pt;font-family:"Menlo",serif;color:#2EAEBB">
</span><span style="font-size:8.5pt;font-family:"Menlo",serif;color:#2FB41D">p</span><span style="font-size:8.5pt;font-family:"Menlo",serif;color:#400BD9">:</span><span style="font-size:8.5pt;font-family:"Menlo",serif;background:#878A04">forcedAuthenticationSupported</span><span style="font-size:8.5pt;font-family:"Menlo",serif">=<span style="color:#B42419">"true"</span><o:p></o:p></span></p>
<p style="margin:0in;margin-bottom:.0001pt;font-stretch:normal"><span style="font-size:8.5pt;font-family:"Menlo",serif;color:#2EAEBB">
</span><span style="font-size:8.5pt;font-family:"Menlo",serif;color:#2FB41D">p</span><span style="font-size:8.5pt;font-family:"Menlo",serif;color:#400BD9">:</span><span style="font-size:8.5pt;font-family:"Menlo",serif;color:#2FB41D">nonBrowserSupported</span><span style="font-size:8.5pt;font-family:"Menlo",serif;color:black">=</span><span style="font-size:8.5pt;font-family:"Menlo",serif;color:#B42419">"false"</span><span style="font-size:8.5pt;font-family:"Menlo",serif;color:#2EAEBB">></span><span style="font-size:8.5pt;font-family:"Menlo",serif;color:#2FB41D"><o:p></o:p></span></p>
<div>
<p class="MsoNormal"><span style="color:#2EAEBB"><br>
<br>
</span><o:p></o:p></p>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<div>
<p class="MsoNormal">On 13Jul, 2021 at 11:36:07, Cantor, Scott <<a href="mailto:cantor.2@osu.edu">cantor.2@osu.edu</a>> wrote:<o:p></o:p></p>
</div>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<div>
<div>
<p class="MsoNormal">That has nothing to do with MFA. The NIH is continuing to set ForceAuthn in their requests and you have chosen to tell the IdP that Duo does not support ForceAuthn, which is up to you. That has nothing to do with the HowTo's topic, which
is why it's not in there.<br>
<br>
I don't know why NIH is continuing to do it, and I don't know whether they will do it in production or not.<br>
<br>
The IdP defaults to Duo supporting ForceAuthn and has since it shipped Duo support. That means you (the collective you) chose to set that flag off.<br>
<br>
-- Scott<br>
<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://urldefense.proofpoint.com/v2/url?u=https-3A__wiki.shibboleth.net_confluence_x_coFAAg&d=DwMFaQ&c=JeTkUgVztGMmhKYjxsy2rfoWYibK1YmxXez1G3oNStg&r=-CYQGhDCW_XVXWqNKPn5s07p1awyFSt0c0S-5qutrqc&m=nXDHFg8-LI78HHFjj2258aDLWt1DgFwt-KEWliRcpTc&s=kzeeeZRxw8kG-usMCWJ8XlQzlmxwanACUj36vf30QsA&e=">
https://wiki.shibboleth.net/confluence/x/coFAAg</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net">
users-unsubscribe@shibboleth.net</a><o:p></o:p></p>
</div>
</div>
</blockquote>
</div>
</div>
</div>
</body>
</html>