Hi
We have CAS 6.0.x configured for MFA with DUO as per CAS docs.
We see a warning in the logs every login/MFA flow that relates to a
response from DUO of
[{"code": 40301, "message": "Access forbidden", "message_detail": "Wrong
integration type for this API.", "stat": "FAIL"}]
when CAS calls the /preauth endpoint as detailed here:
https://github.com/apereo/cas/blob/6.0.x/support/cas-server-support-duo-core/src/main/java/org/apereo/cas/adaptors/duo/authn/BaseDuoSecurityAuthenticationService.java#L194
At the DUO end we are configured for using CAS authentication.
This post https://www.mail-archive.com/[email protected]/msg05943.html
seems to explain what is happening in that the /preauth endpoint is part of
the Duo AUTH API and *not* specifically the Duo CAS API.
Duo's (and the mailing list post's) suggestion to get rid of the warning,
is for us to switch to using the Duo AUTH API in their admin console, which
involves new keys to be generated and deployed.
We can do this but I was wondering:
1) if CAS code is calling the wrong endpoint here and should not be calling
the /preauth url?
or
2) Duo is configured incorrectly in terms of what endpoint calls they
should be supporting as part of their Duo CAS API?
The mailing list post I've included seems to say the latter, whereas Duo
support have responded to me with the former......
It would be good to know what is correct for the latest version of CAS
thanks
--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/675a71e7-5d77-44dc-94a6-64ca4479e72a%40apereo.org.
