Where to put multifactor flows

[Cantor, Scott]

On 7/2/15, 11:08 AM, "dev on behalf of Marvin Addison" <dev-bounces at shibboleth.net on behalf of marvin.addison at gmail.com> wrote:

>Because you said this:
>
>"Can you just build an interceptor that enforces that after the fact?"
>
>I understood interceptor to be the post-authentication interceptors, and that was the basis of my comment.

I meant that you should avoid trying to enforce anything in the Duo flow, and just build a separate flow to enforce whatever it is you're meaning to enforce afterwards. Two flows, one login flow, the other the authz flow.

That said, I'm *not* saying that I think it's trivial/obvious how to build a Duo flow and then glue that to the password flow appropriately. Apparently it's been done, but I honestly don't know how and I'm not sure that aspect of the design is there yet, but I'd much rather focus on that problem in isolation and not try and tie that to a policy issue related to blocking use of password-only.

One way of course is to use that initial-authn feature, set to Password, since that gets that part done for you and leaves you free to do the Duo part during the main authn step. But I'd like to have other options there. We can signal flows now, but I can't think of any obvious way to do the Password flow and somehow route from that to the Duo flow. That's the problem I'd rather focus on.

-- Scott