The following page offers advice for planning and handling outages to the Duo Security service.
Monitoring Duo
Duo offers a specific status page, https://status.duo.com/ with outage information, and is a good place to start.
Bypassing Duo
A few solutions were offered to support a fail-open integration, to allow AuthN to continue in a weakened state:
- Configure IdP to check group membership before prompting for Duo, and remove users from the group to bypass.
- Nebraska uses a CAS Duo Extension configured to check for a specific attribute value memberOf: cn=psp:orgs:idm:DuoEnabled,ou=grouper,ou=group,dc=unl,dc=edu
- ...
Communicating Change in AuthN Context to SPs
When the IdP is authenticating in bypass mode, what should be sent to SPs indicating that the AuthN context is different?
If Duo is part of the assurance, the IdP should not assert the assurance level.