I'm built a PHP class for the Duo Auth API, however the "trusted_device_token" is not working for me. A policy is configured for the application and calls to the "auth" endpoint are returning a trusted_device_token in the response. However, any calls to the preauth endpoint that include the trusted_device_token are returning a list of devices and "auth" as the result, as if I didn't pass a trusted_device_token at all.
Example response from the auth endpoint:
array(2) {
["response"]=>
array(4) {
["result"]=>
string(5) "allow"
["status"]=>
string(5) "allow"
["status_msg"]=>
string(26) "Success. Logging you in..."
["trusted_device_token"]=>
string(156) "<token returned here>"
}
["stat"]=>
string(2) "OK"
}
So in the next call to the preauth endpoint, I'm now passing "username" and "trusted_device_token" as the parameters, using the "trusted_device_token" value returned above. The response from this preauth call is:
array(2) {
["response"]=>
array(3) {
["devices"]=> <device list hidden>
["result"]=>
string(4) "auth"
["status_msg"]=>
string(17) "Account is active"
}
["stat"]=>
string(2) "OK"
}
Whereas I would expect "result" to be "allow" since I sent a valid trusted_device_token. I'm at an unfortunate loss as to why this isn't working and don't want to bill the customer for more fruitless testing.
