<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
So I think I realize now that I misunderstood the video on the Duo Passwordless page. What I think the video demonstrates is a user enrolling in Passwordless with TouchID (allows platform auth only) and then trying to complete the passwordless flow with a roaming
auth which results in a RequestUnsupported. This has nothing to do with PPT at all.</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
So now that I know that, I believe the video is not relevant to the problem I'm seeing.</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
But I did come up with the start of a solution for anyone else trying to figure this out.</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
I added this entry key to my DuoOIDC flow:</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<entry key="proceed" value-ref="checkPPT"/></div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Then I defined a simple script that runs at the very end of the MFA flow:</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<bean id="checkPPT" parent="shibboleth.ContextFunctions.Scripted" factory-method="inlineScript"></div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<constructor-arg></div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<value></div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<![CDATA[</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
nextFlow = "proceed"</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
authContext = input.getSubcontext("net.shibboleth.idp.authn.context.AuthenticationContext")</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
mfaContext = authContext.getSubcontext("net.shibboleth.idp.authn.context.MultiFactorAuthenticationContext")</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
if (!mfaContext.isAcceptable()) {</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
nextFlow = "authn/Password"</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
}</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
nextFlow</div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
]]></div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
</value></div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
</constructor-arg></div>
<div style="font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
</bean></div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
This will prompt the user for username/password at the end if the SP requested PPT, but proceeds if everything passes.</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
Thanks for all the responses so far.</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
- Steve</div>
<div style="direction: ltr; font-family: Aptos, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);">
<br>
</div>
<div id="mail-editor-reference-message-container" style="color: inherit; background-color: inherit;">
<div class="ms-outlook-mobile-reference-message skipProofing">
<meta name="Generator" content="Microsoft Exchange Server" style="color: inherit; background-color: inherit;">
</div>
<div class="ms-outlook-mobile-reference-message skipProofing" style="text-align: left; padding: 3pt 0in 0in; border-width: 1pt medium medium; border-style: solid none none; border-color: rgb(181, 196, 223) currentcolor currentcolor; font-family: Aptos; font-size: 12pt; color: black;">
<b>From: </b>users <users-bounces@shibboleth.net> on behalf of Scott Cantor via users <users@shibboleth.net><br>
<b>Date: </b>Wednesday, March 11, 2026 at 5:43 PM<br>
<b>To: </b>Shib Users <users@shibboleth.net><br>
<b>Cc: </b>Scott Cantor <scott@restingparrotsoftware.com><br>
<b>Subject: </b>Re: DuoOIDC passwordless event handling question<br>
<br>
</div>
<div class="PlainText" style="font-size: 11pt;"><br>
<br>
> On Mar 11, 2026, at 4:47 PM, Steven Premeau via users <users@shibboleth.net> wrote:<br>
><br>
> That said, the exit status of the DuoPlugin will only be based on the Duo authentication. If you wanted (or needed) to check some additional items after that Authentication stage completes and before things are finalized, you would need to define another
step linked to the "proceed" event.<br>
<br>
That's what I meant, the MFA flow won't "guard" it. If you tell it to run a flow, it doesn't care if that flow is or isn't "suitable", it just does it. If the result ultimately isn't what's needed, the failure happens at the very end.<br>
<br>
> I'll defer to Scotts answer on whether it's better to remove the requirement from the SP or try to deal with it on the IDP....<br>
<br>
Well, as a matter of the standard, you don't have a choice. You can fix the SP or lie. PPT is obviously not what the passwordless flow is doing.<br>
<br>
You don't have the leeway to say "but it's better", unless the SP specifies "better" or "minimum" as an operator and not "exact".<br>
<br>
If I were planning to violate the standard, though, I wouldn't lie, I'd add PPT to the list of "ignored" AuthnContext classes. By doing that, the IdP will treat it like "unspecified" and simply not even acknowledge that there was a request made with anything
specific.<br>
<br>
The response is therefore non-compliant, but a broken SP ain't gonna notice.<br>
<br>
But that is all or nothing, it's a global setting.<br>
<br>
-- Scott<br>
<br>
--<br>
For Consortium Member technical support, see <a href="https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!IBzWLUs!SAVrrEoomvlSn0_0GNoZUgXw4OP4E2xhoV0JZSfNvyk8J17T68yMonXSkqXctSQzJFDhPnTLHmaOv_Me$" data-outlook-id="8cba2138-02a6-4de4-a1c9-389fe790fd1d">
https://urldefense.com/v3/__https://shibboleth.atlassian.net/wiki/x/ZYEpPw__;!!IBzWLUs!SAVrrEoomvlSn0_0GNoZUgXw4OP4E2xhoV0JZSfNvyk8J17T68yMonXSkqXctSQzJFDhPnTLHmaOv_Me$</a><br>
To unsubscribe from this list send an email to users-unsubscribe@shibboleth.net<br>
</div>
</div>
</body>
</html>