...
While we have designed and implemented a robust solution of adding Duo MFA to our CAS login, there are two factors to consider for the future. First, there is ongoing efforts in IET to upgrade our Shibboleth server to version 3.2.1 with Duo MFA support. This version includes the ability to respond to both CAS and SAML protocols. This has the implications that Shibboleth could respond to CAS clients, and a standalone CAS server may not be needed. Details on this effort can be found /wiki/spaces/~tsschmidt/pages/249823473. Secondly, future versions of CAS are slated to have full MFA support. This would allow us to address the limitations that are outlined in this document. It would also mean that we could simplify our build process by no longer needing to apply our own patch to CAS source.