<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Hi list,<br>
<br>
We had an incident on the weekend after a firewall update caused access to DUO to be blocked and the Health checked failed.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Subsequently any sites requiring MFA failed authentication.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
SSO password authentication was OK for non MFA protected sites.</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
22024-07-28 00:03:10,338 - 203.189.4.16 - ERROR [net.shibboleth.idp.plugin.authn.duo.impl.HealthCheckDuoOIDCAuthAPI:97] - Profile Action HealthCheckDuoOIDCAuthAPI: Duo API health check failed</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
net.shibboleth.idp.plugin.authn.duo.DuoClientException: Could not execute Duo HTTP request</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
at net.shibboleth.idp.plugin.authn.duo.nimbus.impl.NimbusClient.executeRequest(NimbusClient.java:271)</div>
<div style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
Caused by: java.net.SocketException: Connection reset</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
at java.base/java.net.SocketInputStream.read(SocketInputStream.java:186)</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
2024-07-28 00:03:10,339 - 203.189.4.16 - WARN [org.opensaml.profile.action.impl.LogEvent:101] - A non-proceed event occurred while processing the request: AuthenticationException<br>
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
<br>
</div>
<div class="elementToProof" style="font-family: Aptos, Aptos_EmbeddedFont, Aptos_MSFontService, Calibri, Helvetica, sans-serif; font-size: 11pt; color: rgb(0, 0, 0);">
>From reading from<br>
<a href="https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1374027959/DuoOIDCAuthnConfiguration#Advanced-Topics" id="LPlnk340796">https://shibboleth.atlassian.net/wiki/spaces/IDPPLUGINS/pages/1374027959/DuoOIDCAuthnConfiguration#Advanced-Topics</a></div>
<div id="Signature">
<p><span style="font-family: Arial, sans-serif; font-size: 10pt;"> </span></p>
<p><span style="font-family: Arial, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">Before each Duo 2FA request, a back-channel lookup is made to Duo’s health check endpoint to determine if the Duo servers are accessible and accepting requests. If for some
reason they aren’t, the 2FA attempt fails but the IdP’s authentication flows resume. This is a standard part of Duo’s 2FA workflow. The benefit of this approach is, it occurs before the URL redirect in the browser, and if the Duo 2FA endpoint were not available
the IdP remains in control of the authentication process. Otherwise, the user’s browser might timeout during the 2FA request, or the user might get stuck on an error page of some kind.</span></p>
<div style="margin-top: 1em; margin-bottom: 1em; font-family: Arial, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">
However, this involves an extra, frequent, back-channel network lookup and as such is subject to the same reliability/availability issues as the actual 2FA request. From investigation, it appears possible to bypass this check and still have the 2FA proceed
as normal. Consequently, from v1.3.0 onward we have included a property (<b>idp.duo.oidc.healthcheck.enabled</b>) that allows the deployer to turn off this check.</div>
<p><span style="font-family: Arial, sans-serif; font-size: 10pt;"><br>
</span></p>
<p><span style="font-family: Arial, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">Should the SSO have just continued , basically bypassing MFA?</span></p>
<p><span style="font-family: Arial, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">Is there a configuration we have missed for MFA?</span></p>
<p><span style="font-family: Arial, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);"><br>
</span></p>
<p><span style="font-family: Arial, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">regards</span></p>
<p><span style="font-family: Arial, sans-serif; font-size: 10pt; color: rgb(0, 0, 0);">Gary</span></p>
<p><span style="font-family: Arial, sans-serif; font-size: 10pt;"><br>
</span></p>
<table style="border-collapse: collapse; border-spacing: 0px; box-sizing: border-box;">
<tbody>
<tr>
<td style="border-bottom: 1pt solid rgb(237, 125, 49); padding: 0cm; vertical-align: top; width: 13cm; height: 45.95pt;">
<p><span style="font-family: Arial, sans-serif; font-size: 10pt; color: rgb(218, 61, 15);"><b>Gary Lipscomb</b></span></p>
<p><span style="font-family: Arial, sans-serif; font-size: 9pt;">Technical Officer, Systems</span></p>
<p><span style="font-family: Arial, sans-serif; font-size: 9pt;">IT </span><span style="font-family: Arial, sans-serif; font-size: 9pt; color: rgb(65, 65, 65);">Infrastructure & Security | Division of Information Technology</span></p>
</td>
</tr>
<tr>
<td style="padding: 0cm; vertical-align: top; width: 13cm; height: 65.65pt;">
<p><span style="font-family: Arial, sans-serif; font-size: 10pt;"><br>
Charles Sturt University, Bathurst, NSW 2795</span></p>
<p><span style="font-family: Arial, sans-serif; font-size: 10pt;">Ph: 02 6338 6533</span></p>
<p><span style="font-family: Arial, sans-serif; font-size: 10pt;">Email: </span><span style="font-family: Arial, sans-serif; font-size: 10pt; color: red;"><a href="mailto:glipscomb@csu.edu.au" style="margin-top: 0px; margin-bottom: 0px;">glipscomb@csu.edu.au</a></span><span style="font-family: Arial, sans-serif; font-size: 10pt;"> </span></p>
<p><span style="font-family: Arial, sans-serif; font-size: 10pt; color: rgb(218, 61, 15);"><a href="http://www.csu.edu.au/" style="color: rgb(218, 61, 15); margin-top: 0px; margin-bottom: 0px;">csu.edu.au</a></span></p>
</td>
</tr>
</tbody>
</table>
<p> </p>
<p> </p>
</div>
<!DOCTYPE html>
<title>Charles Sturt University</title>
<style>p {font-family:arial, helvetica, sans-serif;font-size:9px;}</style>
<p><a href="https://www.csu.edu.au" style="text-decoration:none;"><img alt="Charles Sturt" style="height:60px;padding:10px;" src="https://www.csu.edu.au/email/images/charles-sturt-logo/charles-sturt-university-logo.png"></a></p>
<hr>
<p style="font-weight:bold">LEGAL NOTICE</p>
<p>This email (including correspondence comprising an email chain and any attachment) is confidential and is intended for the use of the addressee(s) only. If you are not the intended recipient of this email, you must not copy, distribute, take any action in
reliance on it or disclose it to anyone.<br>
Any confidentiality is not waived or lost by reason of mistaken delivery. Any email should be checked for viruses and defects before opening. Charles Sturt University does not accept liability for viruses or any consequence which arise as a result of this email
transmission. Email communications with Charles Sturt University may be subject to automated email filtering, which could result in the delay or deletion of a legitimate email before it is read at Charles Sturt University. The views expressed in this email
are not necessarily those of Charles Sturt University.</p>
<p><a style="color:#da3d0f;" href="https://www.csu.edu.au">Charles Sturt University in Australia</a> The Grange Chancellery, Panorama Avenue, Bathurst NSW Australia 2795 (ABN: 83 878 708 551). Charles Sturt University - TEQSA Provider Identification: PRV12018
(Australian University). CRICOS Provider: 00005F.</p>
<p>Consider the environment before printing this email.</p>
</body>
</html>