I see you have tried changing the id field in the service definition, but
have you tried using the evaluationOrder field in your service definition?
The lower the number the higher priority it when services are being matched.
Example:
What-9999999.json
{
@class: org.apereo.cas.services.RegexRegisteredService
description: Testing mod_auth_cas and duo
id: 9999999
evaluationOrder: 0,
....
On Wednesday, November 15, 2017 at 9:55:22 AM UTC-7, Mac Reid wrote:
>
> Hi all,
>
> After reading the section on Duo MFA with multiple providers, I have setup
> a couple services to use Duo MFA. My problem is, both CAS/SAML services I
> have configured to use Duo, use just one of the Duo applications rather
> than each service using just one of the Duo applications.
>
> I have tried changing the ordering of the Duo applications, I have tried
> changing the index by which it is configured, and I have tried configuring
> both with the same index. None of these configurations seem to work. The
> only time the second service uses the proper Duo application is when the
> first Duo application is removed from the cas configuration.
>
> The relevant cas configuration is below:
>
> cas.authn.mfa.duo[0].duoSecretKey=
> cas.authn.mfa.duo[0].duoApplicationKey=application key 1
> cas.authn.mfa.duo[0].duoIntegrationKey=integration key 1
> cas.authn.mfa.duo[0].duoApiHost=apihost.duosecurity.com
> cas.authn.mfa.duo[0].id=duo-what.example.com
> cas.authn.mfa.duo[0].name=what.example.com
>
> cas.authn.mfa.duo[1].duoSecretKey=
> cas.authn.mfa.duo[1].duoApplicationKey=application key 2
> cas.authn.mfa.duo[1].duoIntegrationKey=integration key 2
> cas.authn.mfa.duo[1].duoApiHost=apihost.duosecurity.com
> cas.authn.mfa.duo[1].id=shib-test
> cas.authn.mfa.duo[1].name=shib-test
>
> The service registries are below:
>
> What-9999999.json
> {
> @class: org.apereo.cas.services.RegexRegisteredService
> description: Testing mod_auth_cas and duo
> id: 9999999
> name: What
> serviceId: https://what.example.com/.*
> multifactorPolicy: {
> @class:
> org.apereo.cas.services.DefaultRegisteredServiceMultifactorPolicy
> enabled: true
> ssoEnabled: true
> multifactorAuthenticationProviders: ["java.util.LinkedHashSet", ["
> duo-what.example.com"]]
> }
> attributeReleasePolicy: {
> @class: org.apereo.cas.services.ReturnAllowedAttributeReleasePolicy
> allowedAttributes: ["java.util.ArrayList", ["cn", "mail", "sn"]]
> }
> }
>
> Shibtest-1002.json
> {
> @class: org.apereo.cas.support.saml.services.SamlRegisteredService
> description: Testing a Shibboleth SP
> id: 1002
> name: Shibtest
> serviceId: https://what.example.com/sp
> multifactorPolicy: {
> @class:
> org.apereo.cas.services.DefaultRegisteredServiceMultifactorPolicy
> enabled: true
> ssoEnabled: true
> multifactorAuthenticationProviders: ["java.util.LinkedHashSet",
> ["shib-test"]]
> }
> attributeReleasePolicy: {
> @class: org.apereo.cas.services.ReturnMappedAttributeReleasePolicy
> allowedAttributes: {
> @class: java.util.TreeMap
> cn: urn:oid:2.5.4.3
> sn: urn:oid:2.5.4.4
> mail: urn:oid:0.9.2342.19200300.100.1.3
> memberOf: urn:oid:1.2.840.113556.1.2.102
> }
> }
> proxyPolicy: {
> @class: org.apereo.cas.services.RefuseRegisteredServiceProxyPolicy
> }
>
> metadataLocation: /etc/cas/metadata/shib-test.xml
> metadataCriteriaPattern: https://what.example.com/sp
> metadataCriteriaRoles: SPSSODescriptor
> }
>
> I have attached the cas.log for a login session up to the point of Duo. I
> am stumped by this and the docs don't seem to be clear on how this all
> works.
>
> Thanks,
>
> Mac Reid
>
>
>
--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/d8f883e3-60b0-4c84-997c-a68acf19a538%40apereo.org.
