Duo Universal Prompt - ready to go?

[Mike Osterman]

So as not to co-opt Baron's "CAS 6.5 w/ Duo MFA, was MFA actually used?" thread where Ray brings up Universal Prompt, I'm starting a new one.

I seem to remember a while back there were issues with CAS + Duo's Universal Prompt. Is anyone using it successfully/happily in production, or is it better to stay with the previous version of Duo for now? I suspect that my Information Security Officer is about to ask me about it again...

Thanks!

Mike

[Jonathon Taylor]

Hi Mike,

We are on the latest version of CAS 6.5 and using Duo's Universal Prompt since April 5th.  We ran into some initial problems while testing, and specific to the surrogate authentication feature of CAS, but that was fixed.  We are happy with it and have received positive feedback from our users.

--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email to cas-user+u...@apereo.org.
To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/CAEdMQHWitmLUJfHXMt8Q%2BUWaKi18KXi%3DB%3Dk0jcuA4X1a9r-Hyw%40mail.gmail.com.

--

Jonathon Taylor

Information Security Office

jona...@berkeley.edu

[Ian Wat]

We are running on CAS 6.4 but are looking to try out Duo's Universal Prompt. Duo's documentation says that CAS 6.3 or greater should work. Should this work out of the box? I've been trying to look at both Duo and CAS documentation on how to implement but struggle to figure it out. 

Our Duo application universal prompt status is set as App Update Ready. I've tried adding the duo-universal-sdk dependency as described in https://duo.com/docs/duoweb#java but maybe that doesn't apply to a CAS application. I've also updated to the latest 6.4 release. The CAS documentation doesn't mention any configuration changes that are required. What am I missing?

Thanks,

Ian Wat

Bucknell University

To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/CABzqDo8k0zvToCLtEEKQepf0arwFU-wQQr8dWOZFo74Mwx-Tow%40mail.gmail.com.

[Ray Bon]

Ian,

Cas will use old prompt when duo-application-key is in the property file.

Remove it and cas will use the universal prompt.

see https://fawnoos.com/2021/05/07/cas63x-duo-security-mfa-universal-prompt/

Ray

On Fri, 2022-09-02 at 12:46 -0400, Ian Wat wrote:

Notice: This message was sent from outside the University of Victoria email system. Please be cautious with links and sensitive information.

[Ian Wat]

Ray,

Thanks for the tip. It was what I needed. Seems like that should be explicitly stated in the CAS documentation for clarity.

Thanks,

Ian

To view this discussion on the web visit https://groups.google.com/a/apereo.org/d/msgid/cas-user/1bfa84ed824f1698e1b1cdefd80a11b7c1f9a76c.camel%40uvic.ca.