I am having problems getting the ootb duo module to work like the old
mfa-duo module for 4.1. If the ldap entry has the attribute (mfarequired)
populated with the value (TRUE) it correctly loads the duo screen, and
everything is fine. If the attribute is missing or not (TRUE) then it
appears to continue, but then I get an error from the client "*The
validation request for ['ST-xxxxxxxx'] cannot be satisfied. The request is
either unrecognized or unfulfilled."* My assumption would be that the duo
workflow wouldn't even be entered if the user doesn't have TRUE in the
attribute.
Maybe I'm not understanding how the DUO module should behave?
I have the following in cas.properties
# DUO
cas.authn.mfa.duo.duoSecretKey=xxxxxxxx
cas.authn.mfa.duo.rank=0
cas.authn.mfa.duo.duoApplicationKey=xxxxxxxx
cas.authn.mfa.duo.duoIntegrationKey=xxxxxxxx
cas.authn.mfa.duo.duoApiHost=xxxxxxxx.duosecurity.com
cas.authn.mfa.duo.trustedDeviceEnabled=false
# MFA
#cas.authn.mfa.globalProviderId=mfa-duo
#cas.authn.mfa.globalPrincipalAttributeNameTriggers=mfarequired
#cas.authn.mfa.globalPrincipalAttributeValueRegex=true|TRUE
#cas.authn.mfa.globalFailureMode=CLOSED
cas.authn.mfa.requestParameter=authn_method
cas.authn.mfa.authenticationContextAttribute=authnContextClass
cas.authn.mfa.contentType=application/cas
And in the service definition:
"multifactorPolicy" : {
"@class" :
"org.apereo.cas.services.DefaultRegisteredServiceMultifactorPolicy",
"multifactorAuthenticationProviders" : [ "java.util.LinkedHashSet",
[ "mfa-duo" ] ],
"principalAttributeNameTrigger" : "mfarequired",
"principalAttributeValueToMatch" : "TRUE",
"failureMode" : "CLOSED"
}
--
- CAS gitter chatroom: https://gitter.im/apereo/cas
- CAS mailing list guidelines: https://apereo.github.io/cas/Mailing-Lists.html
- CAS documentation website: https://apereo.github.io/cas
- CAS project website: https://github.com/apereo/cas
---
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/31c15df1-7d5b-4e1c-9482-808cbd8cb4ac%40apereo.org.
