Where to put multifactor flows

[Marvin Addison]

>
> So an SP can request MFA but if you set the initial authn flow property to
> Password, it will always run Password if there's no session, regardless of
> what it eventually may have to run for the SP's needs.
>

At face value that's a deal breaker. We rely on the requested principal
mechanism to trigger X.509 auth as a part of our InCommon Silver
compliance. Thus password auth is the default mech unless the SP requests
silver; in that case password auth SHOULD NOT occur.

M <dev-unsubscribe at shibboleth.net>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20150702/92b78a2a/attachment.html>