<div dir="ltr">Fair enough, that detail certainly impacts things.<div><br></div><div>I would still advocate for doing the minimum required (e.g. a single Duo API call) within the MFA script and the rest of the logic in DuoIntegrationStrategy -- I have found it cleaner to keep Duo details within the Duo configuration files.</div><div><br></div><div>Although the risk is greater within the DuoPasswordless scenarios, depending on the percentage of sessions that will make an API call and NOT activate Duo, you may want to utilize a local resource prior to (or in place of) the API call.... with the local resources you are in control of the request limits -- what would your planned approach do if (when) Duo returns a 429 "Try again later" response?</div><div><br></div><div>Steve.</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, Oct 8, 2024 at 5:14 PM Christopher Bongaarts via users <<a href="mailto:users@shibboleth.net">users@shibboleth.net</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><u></u>
<div>
<div>A good suggestion, but there is a Duo
API call that needs to happen in the MFA script to decide whether
to invoke the Duo auth in the first place that I would prefer not
to have to duplicate within the integration strategy...<br>
</div>
<div><br>
</div>
<div>On 10/8/2024 4:10 PM, Steven Premeau
wrote:<br>
</div>
<blockquote type="cite">
<div dir="ltr">Chris -
<div><br>
</div>
<div> If the MFA flow is "always" going to select a Duo
integration, it might make more sense to perform the
calculations and API calls within the DuoIntegrationStrategy
bean. (I believe everything you would be looking at via the
MFA script is also available in DuoIntegrationStrategy.)</div>
<div><br>
</div>
<div> Stuffing the results would certainly work, but might be
overkill if they are only going to be used once after
calculation and not have any other "long term" value.</div>
<div><br>
</div>
<div>Steve.</div>
</div>
<br>
<div class="gmail_quote">
<div dir="ltr" class="gmail_attr">On Tue, Oct 8, 2024 at 4:33 PM
Christopher Bongaarts via users <<a href="mailto:users@shibboleth.net" target="_blank">users@shibboleth.net</a>>
wrote:<br>
</div>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">I'd
like to have my MFA script select between two different Duo <br>
integrations based on calculations and/or API calls happening
as part of <br>
the MFA script (using the current DuoOIDC plugin on IdP
5.1.3).<br>
<br>
I think a reasonable approach would be to stuff the result in
the <br>
AuthenticationContext, then make a <br>
shibboleth.authn.DuoOIDC.DuoIntegrationStrategy bean that
inspects the <br>
result in the AuthenticationContext and returns the
appropriate Duo <br>
integration.<br>
<br>
Any caveats to this approach, or suggestions on alternatives?<br>
<br>
-- <br>
%% Christopher A. Bongaarts %% <a href="mailto:cab@umn.edu" target="_blank">cab@umn.edu</a>
%%<br>
%% OIT - Identity Management %% <a href="http://umn.edu/~cab" rel="noreferrer" target="_blank">http://umn.edu/~cab</a>
%%<br>
%% University of Minnesota %% +1 (612) 625-1809 %%<br>
<br>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" rel="noreferrer" target="_blank">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote>
</div>
</blockquote>
<p><br>
</p>
<pre cols="72">--
%% Christopher A. Bongaarts %% <a href="mailto:cab@umn.edu" target="_blank">cab@umn.edu</a> %%
%% OIT - Identity Management %% <a href="http://umn.edu/~cab" target="_blank">http://umn.edu/~cab</a> %%
%% University of Minnesota %% +1 (612) 625-1809 %%
</pre>
</div>
-- <br>
For Consortium Member technical support, see <a href="https://shibboleth.atlassian.net/wiki/x/ZYEpPw" rel="noreferrer" target="_blank">https://shibboleth.atlassian.net/wiki/x/ZYEpPw</a><br>
To unsubscribe from this list send an email to <a href="mailto:users-unsubscribe@shibboleth.net" target="_blank">users-unsubscribe@shibboleth.net</a><br>
</blockquote></div>