<html><head><meta http-equiv="Content-Type" content="text/html; charset=us-ascii"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;" class=""><br class=""><div><br class=""><blockquote type="cite" class=""><div class="">On Jun 10, 2022, at 6:15 PM, Cantor, Scott via users <<a href="mailto:users@shibboleth.net" class="">users@shibboleth.net</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><span style="caret-color: rgb(0, 0, 0); font-family: Helvetica; font-size: 18px; font-style: normal; font-variant-caps: normal; font-weight: normal; letter-spacing: normal; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration: none; float: none; display: inline !important;" class="">The only way it can be done is with creative use of multiple Duo integrations and scripting logic.<span class="Apple-converted-space"> </span></span></div></blockquote></div><div class=""><br class=""></div><div class=""><br class=""></div>Yes, following the example here: <div class=""><br class=""></div><div class=""> <a href="https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631604/DuoAuthnConfiguration#Multiple-Duo-Integrations" class="">https://shibboleth.atlassian.net/wiki/spaces/IDP4/pages/1265631604/DuoAuthnConfiguration#Multiple-Duo-Integrations</a></div><div class=""><br class=""></div><div class="">with this example:</div><div class=""><span data-renderer-mark="true" class=""></span><strong data-renderer-mark="true" style="caret-color: rgb(23, 43, 77); color: rgb(23, 43, 77); font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Noto Sans", Ubuntu, "Droid Sans", "Helvetica Neue", sans-serif; font-size: 0.857em; letter-spacing: -0.003em; white-space: pre-wrap;" class=""> Multiple Integrations with Distinct Principal Sets</strong><div class=""><br class=""></div><div class="">(you'd need to adjust some of the names in that to the DuoOIDC one)</div><div class=""><br class=""></div><div class=""><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);" class="">we've done it where someone wanted 3 or 4 different Duo policies, where you just make up different AuthnContexts to match each. You decide which actually is used for REFEDS MFA, and make up campus specific names for the other, Like using the allowed remember me period to end the context name (e.g. /everytime if no remember me allowed.) Then associate the appropriate Authn Context with the services you want covered under that policy.</span></div><div class=""><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);" class=""><br class=""></span></div><div class=""><span style="caret-color: rgb(0, 0, 0); color: rgb(0, 0, 0);" class=""><br class=""></span></div><div class="">
<div>--<br class="">Michael A. Grady<br class="">IAM Architect, Unicon, Inc.</div><div class=""><br class=""></div><br class="Apple-interchange-newline">
</div>
<br class=""></div></body></html>