Search code examples
single-sign-oncasapereo

On apereo cas 6.6 MFA can I check for trusted devices before showing the provider selection screen?

Running CAS 6.6.6 and currently we are using g-auth as our MFA provider along with trusted devices. Looking to add in cas-simple also via the provider selection screen.

I have this working, but we want to amend the user journey so that if a users device is trusted they no longer get presented with the provider selection screen.

Currently it flows:

User login page > provider selection > trusted device check > provide MFA/successful login

When ideally we are looking for:

user login page > trusted device check > (if not trusted) provider selection > provide MFA/successful login

I have made sure trusted devices is turned on for both MFA provider, but looking into the classes on CAS it looks like each MFA provider has its own trusted device implementation, so this might not be possible?

Solution

  • so this might not be possible?

    In CAS 6.6.x, this is not possible without coding.