Where to put multifactor flows

[Cantor, Scott]

On 7/7/15, 11:31 AM, "dev on behalf of David Walker" <dev-bounces at shibboleth.net on behalf of dhwprof at gmail.com> wrote:

>We thought about that for the MCB and came to the same conclusion as
>Scott. The issue is that Duo isn't really an authentication method in
>the sense we usually think about authentication.  A  authentication
>method is usually something you call, and it tells you who the user is. 
>Duo and other second-factor-only authentication technologies are
>something you call after you think you know who the user is, and it adds
>to your confidence that what you think is right.  What you'd really like
>is a special kind of "second factor only" flow that has prerequisite
>flows, but (as Scott said) that's a lot of work.

Well, my point about Etienne's suggestion being a lot of work isn't really speaking to how Duo works specifically, but just more generally that adding a lot of orchestration and tracking results of flows just isn't that simple to build and it's pretty big design change to take on.

It may be that Marvin is actually right and this works better as an intercept, but that will involve a fair bit of internal munging around that we'd be better off building more explicit support for if we want to go that way.


-- Scott