Where to put multifactor flows

[Cantor, Scott]

On 7/2/15, 3:55 PM, "Cantor, Scott" <cantor.2 at osu.edu> wrote:

>On 7/2/15, 3:08 PM, "dev on behalf of Marvin Addison" <dev-bounces at shibboleth.net on behalf of marvin.addison at gmail.com> wrote:
>
>>At face value that's a deal breaker. We rely on the requested principal mechanism to trigger X.509 auth as a part of our InCommon Silver compliance. Thus password auth is the default mech unless the SP requests silver; in that case password auth SHOULD NOT occur.
>
>Depends how much work you want to do I guess. You could write code or a script to look at the request yourself and attach it as a conditon to the Password flow so that it doesn't run if you don't want it to.

One improvement that did occur to me would be to change that up a bit so that the RequestedPrincipalContext always gets populated up front, but we toggle on or off whether to honor it with more flexible settings. That way different use cases could be accomodated at the different stages, and the request details would still be pulled out and chewed on consistently.

-- Scott