Where to put multifactor flows

[Marvin Addison]

>
> I meant that you should avoid trying to enforce anything in the Duo flow,
> and just build a separate flow to enforce whatever it is you're meaning to
> enforce afterwards. Two flows, one login flow, the other the authz flow.
>

I see. That distinction wasn't clear to me initially.

That said, I'm *not* saying that I think it's trivial/obvious how to build
> a Duo flow and then glue that to the password flow appropriately.


Looking an an authn flow, my inclination is to simply build a one-off of
the Password flow and add the following after the ValidateUsernamePassword
action:

- SetupTempSubjectContext
- ResolveAttributes
- RemoveTempSubjectContext

Then I have an AttributeContext I can use to optionally execute subsequent
Duo-specific states. The SubjectContext setup is little wonky, but in our
case the username is the subject we want to use, so I can capture the
posted username in a flowScope parameter and trust that it's been
authenticated since subsequent actions fire IFF the password is valid.

My main concern with a custom authentication flow isn't initial
development, it's maintenance over time.

One way of course is to use that initial-authn feature, set to Password,
> since that gets that part done for you and leaves you free to do the Duo
> part during the main authn step.


I'm familiar with that feature in name only. Can you point to a code
reference where I can study for more information?


> But I'd like to have other options there. We can signal flows now, but I
> can't think of any obvious way to do the Password flow and somehow route
> from that to the Duo flow. That's the problem I'd rather focus on.
>

I think a general subflow dispatch feature modeled after the intercept
flows could work well. Defining general requirements would be tough, but at
a minimum an AttributeContext should be available to drive
predicates/conditions for what subflows to invoke.

M
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20150702/f5aeea69/attachment.html>