Where to put multifactor flows

[Cantor, Scott]

On 7/2/15, 2:03 PM, "dev on behalf of Marvin Addison" <dev-bounces at shibboleth.net on behalf of marvin.addison at gmail.com> wrote:

>Created an issue to add support for that to CAS flows:
>https://issues.shibboleth.net/jira/browse/IDP-761

I saw. The SAML beans underneath are scattered all over creation, but the wiring of the steps it's following should be mostly cloneable from that one file.

Originally I was going to do this inside the authn flow, for obvious reasons, but that got ugly and I figured we weren't going to end up with that much duplication by exbedding it, maybe SAML, CAS, OpenID, and that's about it.

>This is the bit I was missing. I saw that FilterFlowsByAttribute only does something meaningful in the presence of an existing IdP session, but that seemed useless to me. Now I see that I might be able to leverage that. I'll do some analysis and report back.
> 

Yes, that was added only after I added the second run of the authn flow as a means of getting one created.

I also just answered my question about how it avoids being screwed up a requesting SP. I don't populate the RequestedPrincipalContext until after I do this initial run. So an SP can request MFA but if you set the initial authn flow property to Password, it will always run Password if there's no session, regardless of what it eventually may have to run for the SP's needs.

-- Scott