Where to put multifactor flows

[Cantor, Scott]

On 7/2/15, 10:54 AM, "dev on behalf of Marvin Addison" <dev-bounces at shibboleth.net on behalf of marvin.addison at gmail.com> wrote:

>I got excited when I first read this suggestion. I immediately thought of installing an additional AuthenticationResult on successful Duo auth; the presence of that artifact in the session would be the enforcement check that prevents circumvention. I just did some recon on that particular implementation, and the obstacle seems to be the requirement for an authentication flow identifier. Since the Duo flow in this case is by definition not an an authentication flow, I don't see how to proceed. Alternatively,
> I don't see any other convenient session artifact to attach the Duo result to.

I'm not following: Duo MUST be an authentication flow. All of my work is based on that assumption. We've gone totally off the rails if it's not.

Why would it not be one?

-- Scott