<!DOCTYPE html>
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body>
<div class="moz-cite-prefix">A good suggestion, but there is a Duo
API call that needs to happen in the MFA script to decide whether
to invoke the Duo auth in the first place that I would prefer not
to have to duplicate within the integration strategy...<br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">On 10/8/2024 4:10 PM, Steven Premeau
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:CAFesmYrKcsDU2RJOOzw12ZLoFyAy_fO5s_HgQgw8F15Xj88_zA@mail.gmail.com">
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<div dir="ltr">Chris -
<div><br>
</div>
<div> If the MFA flow is "always" going to select a Duo
integration, it might make more sense to perform the
calculations and API calls within the DuoIntegrationStrategy
bean. (I believe everything you would be looking at via the
MFA script is also available in DuoIntegrationStrategy.)</div>
<div><br>
</div>
<div> Stuffing the results would certainly work, but might be
overkill if they are only going to be used once after
calculation and not have any other "long term" value.</div>
<div><br>
</div>
<div>Steve.</div>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Tue, Oct 8, 2024 at 4:33 PM
Christopher Bongaarts via users <<a
href="mailto:users@shibboleth.net" moz-do-not-send="true"
class="moz-txt-link-freetext">users@shibboleth.net</a>>
wrote:<br>
</div>
<blockquote class="gmail_quote"
style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">I'd
like to have my MFA script select between two different Duo <br>
integrations based on calculations and/or API calls happening
as part of <br>
the MFA script (using the current DuoOIDC plugin on IdP
5.1.3).<br>
<br>
I think a reasonable approach would be to stuff the result in
the <br>
AuthenticationContext, then make a <br>
shibboleth.authn.DuoOIDC.DuoIntegrationStrategy bean that
inspects the <br>
result in the AuthenticationContext and returns the
appropriate Duo <br>
integration.<br>
<br>
Any caveats to this approach, or suggestions on alternatives?<br>
<br>
-- <br>
%% Christopher A. Bongaarts %% <a
href="mailto:cab@umn.edu" target="_blank"
moz-do-not-send="true" class="moz-txt-link-freetext">cab@umn.edu</a>
%%<br>
%% OIT - Identity Management %% <a
href="http://umn.edu/~cab" rel="noreferrer" target="_blank"
moz-do-not-send="true" class="moz-txt-link-freetext">http://umn.edu/~cab</a>
%%<br>
%% University of Minnesota %% +1 (612) 625-1809 %%<br>
<br>
-- <br>
For Consortium Member technical support, see <a
href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw"
rel="noreferrer" target="_blank" moz-do-not-send="true"
class="moz-txt-link-freetext">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a
href="mailto:users-unsubscribe@shibboleth.net"
target="_blank" moz-do-not-send="true"
class="moz-txt-link-freetext">users-unsubscribe@shibboleth.net</a><br>
</blockquote>
</div>
</blockquote>
<p><br>
</p>
<pre class="moz-signature" cols="72">--
%% Christopher A. Bongaarts %% <a class="moz-txt-link-abbreviated" href="mailto:cab@umn.edu">cab@umn.edu</a> %%
%% OIT - Identity Management %% <a class="moz-txt-link-freetext" href="http://umn.edu/~cab">http://umn.edu/~cab</a> %%
%% University of Minnesota %% +1 (612) 625-1809 %%
</pre>
</body>
</html>