Skip to content

Support Duo bypassing MFA requests#169

Merged
pdecat merged 3 commits intoventh:masterfrom
pdecat:support_duo_mfa_bypass
Oct 12, 2020
Merged

Support Duo bypassing MFA requests#169
pdecat merged 3 commits intoventh:masterfrom
pdecat:support_duo_mfa_bypass

Conversation

@pdecat
Copy link
Collaborator

@pdecat pdecat commented Jul 22, 2020

Duo can be configured to not request MFA when connections come from specific IP addresses.

When that occurs, it directly bypasses MFA and returns the authentication cookie.

Without this PR, the following error occurs when Duo bypasses MFA:

# aws-adfs login --profile=default --region=eu-west-1 --adfs-host=sso.mydomain.com --ssl-verification --session-duration 14400
Sending request for authentication
2020-07-21 13:29:26,882 [authenticator authenticator.py:authenticate] [569451-MainProcess] [139864343611200-MainThread] - ERROR: Cannot extract saml assertion. Re-authentication needed?
Username: me@mydomain.com
Password: 
Sending request for authentication
2020-07-21 13:29:39,260 [authenticator authenticator.py:authenticate] [569451-MainProcess] [139864343611200-MainThread] - ERROR: Cannot extract saml assertion. Re-authentication needed?
This account does not have access to any roles

This has been tested by a coworker and myself from non-specific IP addresses for which MFA is required, and specific IP addresses for which MFA is not required.

@pdecat pdecat marked this pull request as ready for review July 23, 2020 10:00
@pdecat pdecat requested a review from venth July 23, 2020 10:06
@pdecat
Copy link
Collaborator Author

pdecat commented Aug 17, 2020

Internal testing went well, ready to merge IMO.

@pdecat pdecat force-pushed the support_duo_mfa_bypass branch from 1eedc60 to f5a8a19 Compare October 12, 2020 20:18
@pdecat
Copy link
Collaborator Author

pdecat commented Oct 12, 2020

Rebased on master to test Github Actions.

@pdecat pdecat merged commit 817ae21 into venth:master Oct 12, 2020
@pdecat pdecat deleted the support_duo_mfa_bypass branch October 12, 2020 20:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant