Where to put multifactor flows

[Cantor, Scott]

On 7/2/15, 3:08 PM, "dev on behalf of Marvin Addison" <dev-bounces at shibboleth.net on behalf of marvin.addison at gmail.com> wrote:

>At face value that's a deal breaker. We rely on the requested principal mechanism to trigger X.509 auth as a part of our InCommon Silver compliance. Thus password auth is the default mech unless the SP requests silver; in that case password auth SHOULD NOT occur.

Depends how much work you want to do I guess. You could write code or a script to look at the request yourself and attach it as a conditon to the Password flow so that it doesn't run if you don't want it to.

It just all gets so complex that it's more about how bad it is and where it all lives.

I don't think it's a bad idea to just build a big-ass custom login flow to do whatever you need to do. But when I say that, the community perception is "oh, this will take too much expertise". Unfortunately, I think it always will.

-- Scott