<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;">
<div><br>
</div>
<div>
<blockquote type="cite"> On 21 AUG 2023 Duo had a major outage. In the Duo plugin documentation there exists a section for Duo Health Check and it implies that if Duo is down then the Duo redirect is skipped. However, I did not see that happening during the
Duo outage and I'm wondering if either: 1) I misconfigured something 2) my expectations are incorrect or 3) the outage didn't apply to this feature.</blockquote>
</div>
<br>
<blockquote type="cite">Link to the outage postmortem: <a href="https://status.duo.com/incidents/rw7g0q7ztj8f">https://status.duo.com/incidents/rw7g0q7ztj8f</a></blockquote>
<br>
<blockquote type="cite">I have left the duo property for 'idp.duo.oidc.healthcheck.enabled' commented out by default, so I it is enabled in my systems.</blockquote>
<div><br>
</div>
<div>This is sensible. The Health check not only checks the service is available, but that your client is active. It should be enabled by default as Duo say you should call it before every 2FA attempt as part of their workflow. Technically it is not required
for the 2FA to be performed, hence the option to turn it off (but leave it on). It should however 'fail closed’ (skip the redirect) if that check either produces an error from Duo's response, or the client experiences an IO exception. If it did not, that would
be a bug I suspect. </div>
<div><br>
</div>
<div>It should be logged as 'Duo API health check failed’ and give a reason, and give an AuthenticationException. </div>
<div><br>
</div>
<div>I’ll see if I can fake this to test it (beyond the unit tests it has). </div>
<div><br>
</div>
<div>Phil</div>
<mc type="body"><font size="1"><font face="Corbel"><br>
<p>Jisc is a registered charity (number 1149740) and a company limited by guarantee which is registered in England under company number. 05747339, VAT number GB 197 0632 86. Jisc’s registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.<br>
<br>
</p>
<p>Jisc Services Limited is a wholly owned Jisc subsidiary and a company limited by guarantee which is registered in England under company number 02881024, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.<br>
<br>
</p>
<p>Jisc Commercial Limited is a wholly owned Jisc subsidiary and a company limited by shares which is registered in England under company number 09316933, VAT number GB 197 0632 86. The registered office is: 4 Portwall Lane, Bristol, BS1 6NB. T 0203 697 5800.<br>
<br>
</p>
<p>For more details on how Jisc handles your data see our privacy notice here: https://www.jisc.ac.uk/website/privacy-notice</p>
</font></font>
</body>
</html>