Where to put multifactor flows

[Tom Scavo]

I know next to nothing about spring web flows but I understand Duo
pretty well so let me jump in with some comments.

On Wed, Jul 1, 2015 at 4:35 PM, Marvin Addison <marvin.addison at gmail.com> wrote:
>>
>> Or are you reacting to the requirement to do a password-based login up
>> front to get that to work?
>
> Password authentication must succeed in order for the Duo flow to fire. Hope
> that answers the question.

That's not strictly true. Duo requires a user id, that's all. How you
get that user id is not important from a Duo perspective. For example,
a (signed) AuthnRequest could contain a SAML Subject containing the
Duo user id.

Tom