fix duo api breaking change

[thecaffiend]

Appears there was a Duo Mobile breaking api change on or about 2025/06/10. There appears to be a callback needed when initializing authentication.

[thecaffiend]

closing issue and will submit a PR

[erpel]

The quick fix from version 2.12.0 seem to break login for our environment:

$ aws-adfs login --adfs-host=adfs.redacted --session-duration 28000
Sending request for authentication
Waiting for additional authentication
No default authentication method configured.
Please enter your desired authentication method (e.g. "Duo Push", "Passcode", "Phone Call", or "WebAuthn Security Key"): Duo Push
No default authentication device configured.
Please enter your desired authentication device (e.g. "phone1" with "Duo Push" or "Phone Call"), or "None" with "WebAuthn Security Key" or "Passcode": phone1
Triggering authentication method: 'Duo Push' with 'phone1'
Error: Issues when following the Duo result URL after authentication. The error response <Response [500]>

I'll try to post a debug log later, but it seems this fix is not quite universal.

[erpel]

Since the full verbose log has so much sensitive data that's tough to clean up, let's try with the end of the failure first:

send: b'POST /frame/v4/status HTTP/1.1\r\nHost: api-2737a426.duosecurity.com\r\nUser-Agent: python-requests/2.32.4\r\nAccept-Encoding: gzip, deflate\r\nAccept: text/plain, */*; q=0.01\r\nConnection: keep-alive\r\nAccept-Language: en\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nCookie: …"\r\nContent-Length: 92\r\n\r\n'
send: b'sid=frameless-a3decd94-9846-4c53-af99-f4c84325d166&txid=36f671f6-9505-4013-83d1-2c158542441e'
reply: 'HTTP/1.1 200 OK\r\n'
header: Server: Duo/1.0
header: Date: Fri, 25 Jul 2025 06:23:37 GMT
header: Content-Type: application/json
header: Content-Length: 151
header: Connection: keep-alive
header: Cache-Control: no-store
header: Pragma: no-cache
header: Set-Cookie: ...; expires=Fri, 31 Dec 9999 23:59:59 GMT; HttpOnly; Path=/; SameSite=None; Secure
header: Strict-Transport-Security: max-age=31536000
header: Content-Security-Policy: default-src 'self'; frame-src 'self' com-duosecurity-devicehealth://*; img-src 'self'  ; connect-src 'self'    https://127.0.0.1:53100 https://127.0.0.1:53101 https://127.0.0.1:53102 https://127.0.0.1:53103 https://127.0.0.1:53104 https://127.0.0.1:53105 https://127.0.0.1:63100 https://127.0.0.1:63101 http://127.0.0.1:53106 http://127.0.0.1:53107 http://127.0.0.1:53108 http://127.0.0.1:53109 http://127.0.0.1:53110 http://127.0.0.1:53111 https://localhost:53100 https://localhost:53101 https://localhost:53102 https://localhost:53103 https://localhost:53104 https://localhost:53105 https://localhost:63100 https://localhost:63101 
header: X-Content-Type-Options: nosniff
2025-07-25 08:23:37,450 [connectionpool connectionpool.py:_make_request] [65711-MainProcess] [8684478208-MainThread] - DEBUG: https://api-2737a426.duosecurity.com:443 "POST /frame/v4/status HTTP/1.1" 200 151
2025-07-25 08:23:37,451 [helpers helpers.py:trace_http_request] [65711-MainProcess] [8684478208-MainThread] - DEBUG: ================================================================================
Request:
* url: https://api-2737a426.duosecurity.com/frame/v4/status
* headers: {'User-Agent': 'python-requests/2.32.4', 'Accept-Encoding': 'gzip, deflate', 'Accept': 'text/plain, */*; q=0.01', 'Connection': 'keep-alive', 'Accept-Language': 'en', 'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8', 'Cookie': '...', 'Content-Length': '92'}
* body: sid=frameless-a3decd94-9846-4c53-af99-f4c84325d166&txid=36f671f6-9505-4013-83d1-2c158542441e
================================================================================
Response:
* status: 200
* headers: {'Server': 'Duo/1.0', 'Date': 'Fri, 25 Jul 2025 06:23:37 GMT', 'Content-Type': 'application/json', 'Content-Length': '151', 'Connection': 'keep-alive', 'Cache-Control': 'no-store', 'Pragma': 'no-cache', 'Set-Cookie': '...', 'Strict-Transport-Security': 'max-age=31536000', 'Content-Security-Policy': "default-src 'self'; frame-src 'self' com-duosecurity-devicehealth://*; img-src 'self'  ; connect-src 'self'    https://127.0.0.1:53100 https://127.0.0.1:53101 https://127.0.0.1:53102 https://127.0.0.1:53103 https://127.0.0.1:53104 https://127.0.0.1:53105 https://127.0.0.1:63100 https://127.0.0.1:63101 http://127.0.0.1:53106 http://127.0.0.1:53107 http://127.0.0.1:53108 http://127.0.0.1:53109 http://127.0.0.1:53110 http://127.0.0.1:53111 https://localhost:53100 https://localhost:53101 https://localhost:53102 https://localhost:53103 https://localhost:53104 https://localhost:53105 https://localhost:63100 https://localhost:63101 ", 'X-Content-Type-Options': 'nosniff'}
* body: {"stat": "OK", "response": {"status_enum": 5, "status_code": "allow", "result": "SUCCESS", "reason": "User approved", "post_auth_action": "oidc_exit"}}
================================================================================
            
send: b'POST /frame/v4/oidc/exit HTTP/1.1\r\nHost: api-2737a426.duosecurity.com\r\nUser-Agent: python-requests/2.32.4\r\nAccept-Encoding: gzip, deflate\r\nAccept: text/plain, */*; q=0.01\r\nConnection: keep-alive\r\nAccept-Language: en\r\nContent-Type: application/x-www-form-urlencoded; charset=UTF-8\r\nCookie:  ... "\r\nContent-Length: 140\r\n\r\n'
send: b'sid=frameless-...846-4c53-af99-f4c84325d166&txid=...505-4013-83d1-2c158542441e&factor=Duo+Push&device_key=&dampen_choice=False'
reply: 'HTTP/1.1 500 Internal Server Error\r\n'
header: Server: Duo/1.0
header: Date: Fri, 25 Jul 2025 06:23:37 GMT
header: Content-Type: application/json
header: Content-Length: 65
header: Connection: keep-alive
header: Cache-Control: no-store
header: Pragma: no-cache
2025-07-25 08:23:37,479 [connectionpool connectionpool.py:_make_request] [65711-MainProcess] [8684478208-MainThread] - DEBUG: https://api-2737a426.duosecurity.com:443 "POST /frame/v4/oidc/exit HTTP/1.1" 500 65
2025-07-25 08:23:37,480 [helpers helpers.py:trace_http_request] [65711-MainProcess] [8684478208-MainThread] - DEBUG: ================================================================================
Request:
* url: https://api-2737a426.duosecurity.com/frame/v4/oidc/exit
* headers: {'User-Agent': 'python-requests/2.32.4', 'Accept-Encoding': 'gzip, deflate', 'Accept': 'text/plain, */*; q=0.01', 'Connection': 'keep-alive', 'Accept-Language': 'en', 'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8', 'Cookie': '...', 'Content-Length': '140'}
* body: sid=frameless-...846-4c53-af99-f4c84325d166&txid=...505-4013-83d1-2c158542441e&factor=Duo+Push&device_key=&dampen_choice=False
================================================================================
Response:
* status: 500
* headers: {'Server': 'Duo/1.0', 'Date': 'Fri, 25 Jul 2025 06:23:37 GMT', 'Content-Type': 'application/json', 'Content-Length': '65', 'Connection': 'keep-alive', 'Cache-Control': 'no-store', 'Pragma': 'no-cache'}
* body: {"error": "unknown_error", "error_description": "Unknown error."}
================================================================================
            
Error: Issues when following the Duo result URL after authentication. The error response <Response [500]>

Debugging is kind of tedious because I can't figure out yet how to make AD FS / Duo force me through the push workflow every time instead of remembering recent success and skipping it (in which case even 2.12.0 does work).

I appreciate any input - restricting our environment to 2.11.2 is okay for now but I don't want this to become the long term solution.

@thecaffiend can you shed any light on the circumstances that introduce this required callback? We might need to build some kind of detection to send it only when expected by Duo or ignore failures and try to continue.

[pdecat]

Maybe an option can be introduced to make this configurable.