Hi
Bumping this to see if anyone has a response?
The duo class was written by Misagh Moayyed who I think is no longer on the
CAS "payroll" so maybe there might not be a known answer?
Cheers
Nomit
On Monday, 11 May 2020 10:33:59 UTC+1, n99 wrote:
>
> Hi
>
> We have CAS 6.0.x configured for MFA with DUO as per CAS docs.
>
> We see a warning in the logs every login/MFA flow that relates to a
> response from DUO of
>
> [{"code": 40301, "message": "Access forbidden", "message_detail": "Wrong
> integration type for this API.", "stat": "FAIL"}]
>
> when CAS calls the /preauth endpoint as detailed here:
>
>
> https://github.com/apereo/cas/blob/6.0.x/support/cas-server-support-duo-core/src/main/java/org/apereo/cas/adaptors/duo/authn/BaseDuoSecurityAuthenticationService.java#L194
>
> <https://www.google.com/url?q=https%3A%2F%2Fgithub.com%2Fapereo%2Fcas%2Fblob%2F6.0.x%2Fsupport%2Fcas-server-support-duo-core%2Fsrc%2Fmain%2Fjava%2Forg%2Fapereo%2Fcas%2Fadaptors%2Fduo%2Fauthn%2FBaseDuoSecurityAuthenticationService.java%23L194&sa=D&sntz=1&usg=AFQjCNF-tW9SHA653Xzyw6JV7CLsVVT5zA>
>
> At the DUO end we are configured for using CAS authentication.
>
> This post https://www.mail-archive.com/[email protected]/msg05943.html
> seems to explain what is happening in that the /preauth endpoint is part of
> the Duo AUTH API and *not* specifically the Duo CAS API.
>
> Duo's (and the mailing list post's) suggestion to get rid of the warning,
> is for us to switch to using the Duo AUTH API in their admin console, which
> involves new keys to be generated and deployed.
>
> We can do this but I was wondering:
>
> 1) if CAS code is calling the wrong endpoint here and should not be
> calling the /preauth url?
>
> or
>
> 2) Duo is configured incorrectly in terms of what endpoint calls they
> should be supporting as part of their Duo CAS API?
>
> The mailing list post I've included seems to say the latter, whereas Duo
> support have responded to me with the former......
>
> It would be good to know what is correct for the latest version of CAS
>
> thanks
>
>
--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/3a08c00e-5027-48e2-8b95-58e3232173df%40apereo.org.
